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I. Introduction 

Article XI-A of the Pennsylvania Election Code, 25 P.S. §§ 3031.1 etseq., authorizes 
the use of electronic voting systems. Section 1105-A of the Pennsylvania Election Code, 25 
P.S. § 3031.5, requires that the Secretary of the Commonwealth (Secretary) examine all 
electronic voting systems used in any election in Pennsylvania and that the Secretary make 
and file a report stating whether, in his opinion, the electronic voting system can be safely 
used by voters and meets all applicable requirements of the Election Code. 

Upon the request of Dominion Voting Systems Ine. (Dominion), the Department of 
State's Bureau of Commissions, Elections and Legislation (Department) scheduled an 
examination for October 15, 2018 of the Democracy Suite 5.5 voting system. The voting 
system presented for certification in Pennsylvania included the Democracy Suite Election 
Management System (EMS) election management software used in conjunction with the 
following components: 1) ImageCast® X (ICX) Ballot Marking Device (BMD), a ballot 
marking device with Commercial Off The Shelf (COTS) printer, HP LaserJet Pro Printer 
M402dn/HP LaserJet Pro Printer M402dne, for printing marked ballots; 2) ImageCast Preeinet 
Scanner (ICP), a precinct optical scan ballot tabulator that scans, validates and tabulates 
hand-marked paper ballots and ballots produced on the BMD; and 3) ImageCast Central 
Station (ICC), a ballot scanning and tabulating system that can be configured with high 
speed COTS scanners Canon Image Eormula DR-GII30 /Canon Image Eormula DR-MI60- 
II to tabulate ballots in central office. 

The Secretary appointed SLI Global Solutions (SLI) and the Center for Civic Design 
(CCD) as professional consultants to conduct the examination of Democracy Suite 5.5. The 
examination process included a public demonstration and functional examination (functional 
examination), accessibility examination and security testing. The functional and 
accessibility examinations were performed in Room G24A/B of the Commonwealth Capitol 
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Complex - Finance Building, 613 North Street, Harrisburg, PA 17120. Mike Santos, Senior 
Test Manager, and Kyle Johnson, Senior Test Engineer (Functional Examiner), of SLI 
Global Solutions, conducted the functional examination of the Democracy Suite 5.5 
pursuant to Section 1105-A(a) of the Election Code, 25 P.S. § 3031.5(a). Whitney 
Quesenbery, Denis Anson and Michael Weisman (Accessibility Examiner), representing 
CCD, performed an accessibility examination of the Democracy Suite 5.5 system. The 
examinations commenced on October 15, 2018, and lasted approximately four days. 
Jonathan Marks, Commissioner of the Bureau of Commissions, Elections and Legislation; 
Kathryn Boockvar, Senior Advisor to the Governor on Election Modernization; Jessica 
Myers, Deputy Director, Office of Policy; Kathleen Kotula, Executive Deputy Chief 
Counsel, Office of Chief Counsel; and Sindhu Ramachandran, Voting Systems Analyst, 
represented the Secretary of the Commonwealth. Jessica Bowers, Director of Certification, 
and Matt Coffey, Systems Specialist, represented Dominion. Additional staff members 
from the Department also attended the examination. The functional examination was open 
to the public and was videotaped by Department staff. Security testing of the Democracy 
Suite 5.5 system was performed at SLI facilities located at 4720 Independence Street, Wheat 
Ridge, Colorado, prior to the functional examination. Mike Santos, Senior Test Manager, 
and Jesse Peterson, Security Specialist, at SLI Global Solutions, served as the Security 
Examiner for the Democracy Suite 5.5 security testing. The Functional Examiner and 
Accessibility Examiner concluded that the Democracy Suite 5.5 did not comply with 
Sections 1107-A(10) and (15), 25 P.S. §§ 3031.7(10) & (15), of the Pennsylvania Election 
Code because the ICX BMD did not allow the voter to remove all candidate selections in a 
contest after voting straight party and the screen referenced the process of marking and 
printing the ballot as “casting” the ballot. Additionally, the Security Examiner noted that the 
system hardening measures documented in the Technical Data Package (TDP) required 
additional modifications for a secure implementation. 

Thereafter, Dominion incorporated corrections for the issues identified during the 
Democracy Suite 5.5 examination, and re-submitted the new release. Democracy Suite 
5.5A, to both the U.S. Election Assistance Commission (EAC) for federal approval and the 
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Department for state certification. The system components remained the same and the only 
change in the new release was the software enhancements to remediate the identified 
anomalies. The Functional Examiner performed a follow-up examination of Democracy 
Suite 5.5A on December 5-6, 2018, at SLI Global Solutions located at in Wheat Ridge, 
Colorado. Department staff observed the examination via web conference. The 
examination was videotaped by SLI and the video is on file at the Department. The Security 
Examiner validated that the documentation has been updated to reflect accurate system 
hardening steps for a secure implementation. Since the software changes made to the 
Democracy Suite 5.5A system were specifically to remediate the identified anomalies in 
Democracy Suite 5.5, it was determined that the results of the accessibility examination and 
security testing conducted as part of the Democracy Suite 5.5 examination may be utilized 
for Democracy Suite 5.5A certification. The Department discussed the software 
modifications with the Accessibility Examiner, since both the straight party usability issue 
and usage of the word “cast” were also part of the Accessibility test findings. 

II. The Democracy Suite 5.5A Voting System 

Democracy Suite 5.5A components considered for use in Pennsylvania^ provide a 
paper-based voting system with end-to-end election support, from defining an election to 
generating final reports. The system is comprised of both precinct and central count 
tabulators, and BMDs as the ADA component. The system components include: the 
Election Management System (EMS), the ImageCast Central (ICC) - utilizing two 
Commercial Off the Shelf (COTS) scanners, the ImageCast Precinct (ICP) optical scanner 
and the ImageCast X (ICX) (Prime and Classic) ballot marking devices. 

The following is a description of the Democracy Suite 5.5A components summarized 
from Section 2.0 (System Overview) of the Test Report for Examination of Democracy 
Suite 5.5A, prepared by the Eunctional Examiner and documentation submitted by 


' The EAC certified system includes a DRE option for the ICX device which is not considered for 
certification in Pennsylvania. 
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Dominion as part of the Technical Data Package (TDP). 


Election Management System (EMS) 

The Dominion Democracy Suite 5.5A EMS supports elections on the ICX Prime, 

ICX Classic, ICP and ICC systems. The EMS set of applications are responsible for all pre¬ 
voting and post-voting groups of activities in the process of defining and managing 
elections. EMS software platform consists of end-user (client) and back-end (server) 
applications. The EMS platform consists of the following major components. 

EMS Election Event Designer (EED) - Supports pre-voting activities including 
election definition together with ballot styling capabilities. 

EMS Audio Studio (AS) - End-user helper application used to record audio files for a 
given election project utilized during the pre-voting phase of the election cycle. 

EMS Application Server - Server-side application responsible for executing long 
running processes, such as rendering ballots, generating audio files and election files, etc. 

EMS Results Tally and Reporting (RTR) - Integrates election results acquisition, 
validation, tabulation, reporting, and publishing capabilities and represents a main post¬ 
voting phase end-user application. 

EMS Eile System Service (ESS) - Stand-alone service that runs on client machines, 
enabling access to low level operating system API for partitioning CE cards, reading raw 
partition on ICP CP card, etc. 

EMS Data Center Manager (DCM) - End-user application used to export election 
data from election project and import election data into election project. 

EMS Election Data Translator (EDT) - End-user application used to export election 
data from election project and import election data into election project. 

EMS Adjudication (ADJ) and EMS Adjudication Service - Server and client 
components responsible for adjudication, including reporting and generation of adjudicated 
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result files from ImageCast Central tabulators and adjudication of write-in selections from 
ImageCast Precinct and Image Cast Central tabulators. 

ImageCast Voter Activation (ICVA) - Installed on a workstation or laptop at the 
polling place, that allows the poll workers to program smart cards for voters. The smart 
cards are used to activate voting sessions on ImageCast X. 

ImageCast X (ICX) Ballot Marking Device (BMD) 

The ICX ballot marking platform is used for creation of paper cast vote records. 

These ballots can be scanned, reviewed, cast and tabulated at the polling location on an ICP 
or later scanned and tabulated by the ICC at a central location. The ICX consists of two 
models, ICX Prime and ICX Classic. 

2.3 ImageCast Precinct (ICP) 

The ICP is a hybrid precinct optical scan ballot counter designed to provide ballot 
scanning, ballot review and tabulation at a polling place. 

2.4 ImageCast Central (ICC) Count Scanner 

The ICC is a high-speed, central ballot scan tabulator based on Commercial off the 
Shelf (COTS) hardware, coupled with the custom-made ballot processing application 
software. It is used for high speed scanning and counting of paper ballots. 

Manufacturer Software/Firmware 

The Dominion Democracy Suite 5.5A voting system consists of the following software and 
firmware components: 


Application 

Version 

EMS Election Event Designer (EED) 

5.5.12.1 

EMS Results Tally and Reporting (RTR) 

5.5.12.1 

EMS Application Server 

5.5.12.1 

EMS Eile System Service (ESS) 

5.5.12.1 

EMS Audio Studio (AS) 

5.5.12.1 

EMS Data Center Manager (DCM) 

5.5.12.1 
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Application 

Version 

EMS Election Data Translator (EDT) 

5.5.12.1 

ImageCast Voter Activation (ICVA) 

5.5.12.1 

EMS Adjudication 

5.5.8.1 

EMS Adjudication Service 

5.5.8.1 

Smart Card Helper Service 

5.5.12.1 

ImageCast Precinct 

5.5.3-0002 

ImageCast Central 

5.5.3.0002 

ImageCast X 

5.5.10.30 


COTS Software/Firmware 

Additional COTS software and firmware included in the system has been defined as 
part of the EAC system certification scope that will be added to this report as Attachment A 
once the final certification is granted for Democracy Suite 5.5A. 


III. EXAMINATION APPROACH, PROCEDURES AND RESULTS 
A. Examination Approach 

To ascertain whether Democracy Suite 5.5A can be safely used by voters at 
elections in the Commonwealth and meets all the requirements of the Pennsylvania Election 
Code, the Examiners developed test protocols for the examination. The initial functional 
examination of Democracy Suite 5.5 held October 15 through 19, 2018, determined that the 
system did not comply with Sections 1107-A(10) and (15), 25 P.S. §§ 3031.7 (10) & (15). 
The Examiners observed the following issues: 

1. The ICX-BMD did not allow a voter to deselect all choices in a contest after voting 
straight party when the voter attempted to do so. Instead, a warning message that 
required no user acknowledgment displayed above the contest indicating that their 
“implicit” straight party selections would remain in effect. The screen presented to 
the voter had all the selections deselected and when the voter printed the ballot, the 
paper ballot indicated votes for the candidates chosen by the straight party option. 
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The warning message wording did not clearly indicate the intent. Also, the message 
displayed was not intuitive enough for a voter to notice it and there was no 
acknowledgment action required of the voter indicating that the message was seen. 

2. The ICX-BMD final screen presented to the voter indicated that the voter was about 
to cast their ballot, even though the voter was only printing the ballot which needs to 
be further scanned by the ICP or ICC. 

Dominion remediated the software issues and the Examiners then performed a 
follow-up examination of Democracy Suite 5.5A to confirm that the anomalies identified in 
Democracy Suite 5.5 were corrected and the system complies with all the requirements of 
the Pennsylvania Election Code. The examination approach followed for Democracy Suite 
5.5 and Democracy Suite 5.5A is discussed in the below sections. 

Democracy Suite 5.5 Examination Approach 

Functional Examination 

The test protocols separated the requirements of Article XI-A of the Pennsylvania 
Election Code, Sections 1101-A to 1122-A, 25 P.S. §§ 3031.1 - 3031.22, into six main areas 
of test execution: (1) Source Code Review; (2) Documentation Review; (3) System Level 
Testing; (4) Security/Penetration Testing; (5) Privacy Analysis; and (6) Usability Analysis. 

Source Code Review was performed prior to the functional examination to determine 
if there were any vulnerabilities found that would warrant additional security examination. 

Documentation Review was performed to verify that the portions of the Pennsylvania 
Election Code, which reference documentation detail, are sufficiently met by the Dominion 
Democracy Suite 5.5 documentation. The Eunctional Examiner validated compliance of the 
system to the following sections of the Election Code during the documentation review. 

• 1105-A(a), 25 P.S. § 3031.5(a), requiring that an electronic voting system has been 
examined and approved by a federally recognized IT A; 

• II07-A(II), 25 P.S. § 3031.7(11), requiring an electronic voting system to be 
suitably designed in terms of usability and durability, and capable of absolute 
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accuracy; 


• 1107-A(13), 25 P.S. § 3031.7(13), requiring an electronic voting system to 
correctly tabulate every vote; 

• 1107-A(14), 25 P.S. § 3031.7(14), requiring an electronic voting system to be 
safely transportable; and 

• 1107-A(15), 25 P.S. § 3031.7(15), requiring an electronic voting system to be 
designed so voters may readily understand how it is operated. 

System Level Analysis examined the Dominion Democracy Suite 5.5 voting system 
by conducting an election starting with creating an election definition using EMS and then 
creating the election media needed to populate the voting devices (the ICX - Classic and 
Prime with COTS printer HP LaserJet Pro Printer M402dn, ICP, ICC with COTS scanners - 
Canon DR-G1130 and Canon DR-M160-11). Ballots were marked, manually as well as via 
both models (Classic and Prime) of the ICX ballot marking device, and tabulated through 
the ICP and ICC (both COTS scanners). The results reports were validated against the 
expected results of the voted ballots. All components of the Democracy Suite 5.5 system 
were exercised to verify that they met all pertinent requirements of the Pennsylvania 
Election Code. The test cases were designed to ascertain compliance with the following 
sections of the Election Code: 


• 1101-A, 25 P.S. § 3031.1, requiring an electronic voting system to provide fora 
permanent physical record of all votes cast; 

• 1107-A(2), 25 P.S. § 3031.7(2), requiring an electronic voting system to permit 
voting on both candidates and ballot questions, according to the official ballot; 

• 1107-A(3), 25 P.S. § 3031.7(3), requiring an electronic voting system to permit 
straight party voting, including the "Pennsylvania method" of straight party 
voting; 

• 1107-A(4), 25 P.S. § 3031.7(4), requiring an electronic voting system to permit a 
voter to vote for candidates of all different parties, and write-in candidates; 

• 1107-A(5), 25 P.S. § 3031.7(5), requiring an electronic voting system to permit a 
voter to enter write-in votes; 

• 1107-A(6), 25 P.S. § 3031.7(6), requiring an electronic voting system to permit 
a voter to cast votes for candidates and ballot questions he or she is entitled to 
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vote for, and prevents a voter from casting votes the voter is not entitled to vote 
on; 

• 1107-A(7), 25 P.S. § 3031.7(7), requiring an electronic voting system to prevent 
over-votes; 

• 1107-A(8), 25 P.S. § 3031.7(8), requiring an electronic voting system to prevent 
a person from casting more than one vote for a candidate or question, except 
where this type of cumulative voting is permitted bylaw; 

• 1107-A(9), 25 P.S. § 3031.7(9), requiring an electronic voting system to permit 
voters to vote in their own parties' primaries, and prevents them from voting in 
other parties' primaries, while also permitting voters to vote for any nonpartisan 
nomination or ballot question they are qualified to vote on; and 

• 1107-A(10), 25 P.S. § 3031.7(10), requiring an electronic voting system that 
registers votes electronically to permit voters to change their votes up until taking 
the final step to register the vote, and for systems that use paper ballots or ballot 
cards, permits a voter to get a new ballot in the case of a spoiled ballot, and to 
mark and cancel the spoiled ballot; 

• Parts of 1107-A(16), 25 P.S. § 3031.7(16), requiring an electronic voting system 
which provides for district-level tabulation to include (i) a public counter to 
register how many ballots are submitted to be counted; (iv) will not tabulate an 
over-vote, with an option to notify a voter of an over-vote if used during voting 
hours; and (v) generates a printed record that counters are set to zero before 
voting commences; and 

• Parts of 1107-A(17), 25 P.S. § 3031.7(17), requiring an electronic voting system 
which provides for central-count tabulation to (ii) preclude tabulation of an over¬ 
vote; and (iii) indicate that counters are set to zero before processing ballots, 
either by district or with the capability to generate cumulative reports. 

The Functional Examiner also used the System Level Testing to further evaluate the 
design and accuracy aspects of the system as required by Sections 1107-A(11) and (13), 25 
P.S. §§ 3031.7(11) & (13), through his use at public demonstration, in addition to the 
requirements being validated in the documentation review phase by reviewing EAC 
certification reports. 


The Security/Penetration Analysis examined the voting system’s compliance with the 
requirements of the Pennsylvania Election Code by analyzing physical security procedures 
and impoundment of ballots. Precinct tabulation devices were installed for delivery to the 
precinct, and the Eunctional Examiner analyzed the pertinent security procedures performed 
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on each device to ascertain compliance with Section 1107-A(12), 25 P.S. § 3031.7(12), 
requiring an electronic voting system to provide acceptable ballot security procedures and 
impoundment of ballots to prevent tampering with or substitution of any ballots or ballot 
cards. The Functional Examiner also used the security analysis phase of testing to validate 
compliance with parts of Sections 1107-A(16) and (17), 25 P.S. §§ 3031.7(16) & (17), that 
relates to system security. 

The Privacy Analysis examined the voting system’s compliance with Section 1107- 
A(l) of the Election Code, 25 P.S. § 3031.7(1), requiring that an electronic voting system 
provide for absolute secrecy of the vote, by analyzing how the polling place devices met the 
pertinent privacy requirements. 

The Usability Analysis evaluated the compliance of the voting system with Sections 
1107-A(14) and (15), 25 P.S. § 3031.7(14) & (15). The results from the tests were used by 
the Eunctional Examiner to supplement his conclusions from the documentation review 
phase. 


Accessibility Examination 

The accessibility examination was designed to provide insights about each voting 
system’s usability and accessibility especially for voters with disabilities, as well as how 
effectively the system could be deployed by poll workers and voters. The Accessibility 
Examination included a team of three examiners with accessibility, usability and election 
process experience, collectively referred as Accessibility Examiner. The examination 
process was divided into three parts: 

• Expert review by the Accessibility Examiner, using scenarios based on personas 
of people with disabilities from National Institute of Standards and Technology 
(NIST) and their professional experience. 

• Voters with disabilities used the system voting a reasonable length PA ballot and 
completed a questionnaire about their experience. The Accessibility Examiner 
observed and made notes. 
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• Election ofUcials and poll workers tested the accessibility features to evaluate 
how they would be activated during an election. They commented on the system 
based on their experience. 

The testing team determined the test ballot parameters and constructed a typical PA 
ballot, with a mix of contest types and variation in the number of candidates to be voted for 
each contest. The ballot contained 14 contests: 1 straight party contest, 1 vote for a pair 
(President/Vice President), 7 vote for one, 2 vote for not more than three, 1 vote for not 
more than five, 1 referendum contest and 1 retention contest. The facilitator instructed 
voters on the vote selections to be made, so that results could be compared between each 
session and different examinations. 

Security Testing 

The Security testing provided a means to assess the required security properties of 
the voting system under examination and ascertain compliance with PA Election Code 
requirements, including 25 P.S. §§ 3031.7(11), (12), (16) and (17). The security tests were 
based on the PA Voting System Security Standard, published as Attachment E to the 
Directive for Electronic Voting Systems. The Security Examiner conducted tests that 
covered the following areas of testing - documentation review, design, software security, 
network capabilities, audit logging, physical security and penetration testing. 

Democracy Suite 5.5A Examination Approach 

Democracy Suite 5.5A is a release to correct the anomalies noted in Democracy Suite 
5.5 system. The examiners evaluated the changes submitted by Dominion and developed 
test protocols to validate the modifications to Democracy Suite 5.5 to ensure that the fixes 
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resolved the identified anomalies and that the modified system maintained compliance with 
all the PA Election Code requirements. 

Functional Examination 

The Functional Examiner and Department agreed that the test approach must include 
Documentation Review, Source Code Review, System Level Testing and Usability 
Analysis. Security/Penetration and Privacy analysis results were leveraged from Democracy 
Suite 5.5 examination since those aspects of the system remained unaffected by the isolated 
code changes made to the system. 

Documentation review was performed to verify that the portions of the Pennsylvania 
Election Code, which reference documentation detail, are sufficiently met by the Dominion 
Democracy Suite 5.5A documentation. Source code review was done to determine if there 
were any vulnerabilities that warranted additional testing and the review focused on source 
code modifications for the Democracy Suite 5.5A release. System Level Testing examined 
Democracy Suite 5.5A by conducting a general election and closed primary election. The 
election runs were to (a) test and confirm that the anomalies identified during Democracy 
Suite 5.5 examination were remediated, and (b) to perform regression testing of all 
components of the system. The election runs allowed the Functional Examiner to ascertain 
that the compliance with the Election Code requirements determined during the System 
Level Testing of Democracy Suite 5.5 is maintained in the new release. Usability analysis 
was performed to verify that the usability concerns identified during the examination of 
Dominion Democracy Suite 5.5 is remediated in the new release. 

Security Testing 

The Department of State in consultation with the Security Examiner decided that the 
test approach must include only validating the documentation updates to ensure secure 
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implementation of the system components, since the isolated code changes did not affect the 
security aspects of the system. 

Accessibility Examination 

The Department of State, in consultation with the Accessibility Examiner, decided 
that the findings from Democracy Suite 5.5 Accessibility Examination can be used for 
Democracy Suite 5.5A, since there were no hardware changes and the isolated code changes 
were for correcting the anomalies identified during Democracy Suite 5.5. The Department 
discussed the software changes done for the ICX with the Accessibility Examiner, since 
Accessibility testing also reported the same usability concerns identified during Eunctional 
Examination. 

B. Examination Process and Procedures 

The examination process and procedures followed for the Democracy Suite 5.5 and 
Democracy Suite 5.5A examinations are listed in the sections below. The final 
determination in this report is based on the combined analysis of the results and conclusions 
from both examinations. 

Democracy Suite 5.5 Examination 

Functional Examination 

The public demonstration and functional examination portion commenced on 
October 15, 2018, at Room G24A/B of the Commonwealth Capitol Complex - Finance 
Building, 613 North Street, Harrisburg, PA 17120. The test execution tasks took 
approximately four days. Members of the public were allowed as observers for the 
examination. The Functional Examiner performed System Level Testing, 
Security/Penetration Testing and Privacy and Usability Analysis during the examination. 
Source code and Documentation review were completed prior to the public examination at 
SLI lab facilities in Wheat Ridge, Colorado. 

Dominion supplied all the hardware equipment required for the examination. All 
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software and firmware necessary to perform the examination was received directly from the 
Voting System Test Laboratories (VSTL) that tested the voting system for EAC 
certification. The trusted build of the software and firmware for each device being 
evaluated were installed using the appropriate media for installation. The hash codes for all 
system components were captured using the process listed in the manufacturer’s Technical 
Data Package (TDP) by the Functional Examiner with assistance from Dominion 
representative. The Functional Examiner further compared and confirmed that all the 
captured hash codes matched the hash codes for the EAC certified system executables 
before executing the test scripts. 

The Functional Examiner created the election definition using EMS - FED and 
transport media was created to populate the devices under examination with the election. 

The polling place was set up using ICP and ICX - BMD (Classic and Prime). A primary and 
general election were then run using polling place devices and central scanners. Ballots were 
tabulated at the polling place using ICP and ICC using scanners Canon imageFormula DR- 
GI130 and Canon imageFormula DR-M160II. Results were then tabulated using EMS and 
validated against expected results. 

Accessibility Examination 

The accessibility examination portion commenced on October 15, 2018, at Room 
G24A/B of the Commonwealth Capitol Complex - Finance Building. The examination 
lasted approximately three days followed by a debrief meeting on October 18, 2018, with 
DOS and CCD to discuss initial findings. The examination included expert review by the 
Accessibility Examiner, sessions with four poll worker groups, and sessions with six voters 
with disabilities using different accessible devices for voting. The voter sessions each took 
approximately an hour. The poll worker sessions took approximately one hour to 90 minutes 
each. Dominion supplied the hardware and supplies for the Accessibility Examination. The 
equipment was prepared for the examination by loading the required election definition 
using transport media. This test examined the Dominion Voting ImageCast X (ICX) touch 
screen ballot marking device with COTS printer HP LaserJet Pro Printer M402dne and the 
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ImageCast Precinct Optical Scanner (ICP). 


The typical accessible voting experience involves the voter making selections on the 
ICX to mark their ballot, printing their ballot using a separate printer, and then scanning 
their printed ballot on the ICP to cast the ballot. The Accessibility Examiner identified the 
accessibility features of each component as listed below: 

ICX accessibility features: 

• ADA compliant voting booth 

• Touch screen, in portrait orientation 

• Audio ballot with two voices: a prerendered, tactile keypad instructions voice 
and a ballot content, text-to-speech voice 

• Tactile key pad with different-shaped, braille encoded buttons 

• Binary input/Dual switch jack (on tactile key pad) 

• Audio output jack 

• Dual switch “jelly bean” buttons 

• Sip-and-puff device, mountable to the table with adjustable arm 

• Voter settings: 

■ Language choice 

■ Audio volume and tempo changes 

■ Text Size (default, “Big”) 

■ Screen contrast options: color, white background with black text, 
and black background with white text 

■ Screen blank, while using the audio only 

ICP scanner features 

The ICP scanner had no notable accessibility features. 

The machine features listed above are not exhaustive. For more information about 
the Dominion Democracy Suite 5.5 system, refer to the vendor provided technical 
specifications. 

The Accessibility Examiner prepared voting scenarios for each voting session to 
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allow comparison of results between each session. Both the ballot contents and the 
instructions for marking the ballot were designed to exercise different types of interactions 
(navigation in ballot, navigation in contest, undervotes, overvotes, straight party, navigation 
within the review/summary screen, making changes to a contest from the review/summary 
screen). The ballot included both very short contests, and those long enough to potentially 
fill more than one screen, even at the default text size. 

The Accessibility Examination does not produce a typical voting session, but it 
provides a structured opportunity to explore how the voting system works in all interaction 
modes including: 


• Visual display mode with default settings and use of enhanced options for text 
size, brightness, and contrast 

• Audio format with options for volume and tempo 

• Touch input and navigation on the display screen 

• Input and navigation using a tactile keypad 

• Input and navigation using a dual switch 


Expert Review by Accessibility Examiner 

The Accessibility Examiner used the same ballot and instructions to be used for voter 
and poll worker review, for their expert review, so they would be familiar with the 
interaction voters would experience. 

Sessions with voters 

Each voter session took about an hour. They included: 

• An opening interview about their previous voting experience and the types of 
assistive technologies they use in daily life and in voting. 

• A very basic orientation to the system with opportunities for voters to ask 
questions about any assistive technologies available. 
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• Set-up of the maehine using the provided assistive aeeess features based on 
the needs of the individual voter. Where a blind voter would typieally use the 
provided or personal headset to listen to the audio instruetions, the tests used 
an external speaker so that the testers eould inquire about the voters 
understanding of the instruetions. 

• Voting a ballot following faeilitator-guided voting instruetions, and faeilitator 
help only where neeessary. Voters were eneouraged to give feedbaek about 
their experienees, both positive and negative, as they went through the ballot. 
The Aeeessibility Examiner and the voters diseussed any feedbaek and 
questions that oeeurred during the voting sessions and re-evaluated any 
findings as neeessary. 

• A elosing interview ineluding a questionnaire about their voting experienee 
and reaetions to the system. 

Sessions with poll worker groups 

Each poll worker session took approximately an hour and a half, depending on the group 
size and provided the most activity variability. Each session included: 

• A brief orientation to the voting systems and the accessibility features, 
similar to a poll worker training. 

• An opportunity for the poll workers to review vendor-provided instructions 
before trying the system. They marked ballots and experimented with the 
accessibility features. 

• An opportunity for the poll workers to interact with two to t hree different 
access-needs scenarios, depending on the size of the group and available 
time. Each scenario involved an examiner role-playing as a voter with an 
unspecified disability. In some scenarios, the voter didn’t immediately 
identify their disability. Since this was not intended to test the poll- 
worker’s ability to determine appropriate accommodations, each simulated 
voter provided information about the accommodations they needed in 
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general language. This sometimes required the poll worker to ask the voter 
what additional assistance she or he might need. Then the poll worker 
activated the necessary accessibility features for the voter. Note: due to 
lack of time, the final poll worker group did not participate in the examiner 
role-plays. 

The Accessibility Examiner took notes about aspects of the system that worked well 
and problems they encountered during all three phases of the examination. The issues were 
then categorized based on their impact on a voter’s ability to vote independently and 
privately. 


• Positives - things that voters mentioned as meeting or exceeding their 
expectations 

• Annoyances — things voters mentioned as problems, but which did not 
significantly slow their progress in marking their ballot 

• Problem solving — instances where voters hesitated and had to figure out 
how to complete an action or task, but were able to do so on their own, by 
exploring the system or relying on past experience with technology 

• Needs assistance - problems that could only be solved with help, such as 
instructions or assistance from a poll worker 

• Likely to prevent independent voting for voters with some disabilities- 
problems that will prevent successful independent and private voting for 
voters with some disabilities, even with good knowledge about how to use 
the system and accessibility features 

The Accessibility Examiner then compiled the findings including categorizations 
from the examination into a report submitted to the Secretary. 

Security Testing 

The Security Testing was done at SLI lab facilities in Wheat Ridge, Colorado. The 
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Security Examiner received the hardware devices from Dominion and the software and 
firmware were obtained from the Voting System Test Lab (VSTL) which tested the system 
for EAC certification testing. The Examiner installed the Trusted Build prior to the 
evaluation using the appropriate media for installation. The Security Testing is comprised of 
a series of test suites which are utilized for verifying that a voting system will correspond to 
applicable security requirements within the Pennsylvania Election Code and PA Security 
Standards. The Security Examiner evaluated each component of the Democracy Suite 5.5 
system and the system as a whole for interactions between components. These test suites 
covered areas of documentation review, design, software security, network capabilities, 
audit logging, physical security of the voting systems. 

The requirements associated to each area of testing were applied to the Democracy 
Suite 5.5 system in the following manner. The Security Examiner did a review of the EAC 
testing reports of the system and executed tests for a cross section of Voluntary Voting 
System Guidelines (VVSG)l.O requirements to reconfirm compliance. The Security 
Examiner then designed tests that included in depth verification and validation of reports, 
audit logs and physical and logical access controls for each of the components of the voting 
system. The physical security examination included security seals, lock/key combinations, 
measures for collection of voting in the event of an extended power outage, ballot box and 
system access points. Tests were done to ensure that election results, media used, reports and 
audit logs were protected from attempts to decrypt, manipulate and corrupt election data. The 
Security Examiner also created a vulnerability assessment and performed penetration testing 
of the Democracy Suite 5.5 system. 

Dominion Democracy Suite 5.5A examination 

Functional Examination 

The follow-up examination was conducted on December 5 and 6, 2018, at SLI Global 
Solutions facility, 4720 Independence Street, Wheat Ridge, Colorado, and was observed by 
Department staff remotely in a conference room in BCEL, 210 North Office Building, 401 
North Street, Harrisburg, Pennsylvania via web conference. Dominion supplied all the 
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hardware equipment required for the examination. All software and firmware necessary to 
perform the examination was received directly from the VSTL that tested the voting system 
for EAC certification. The Functional Examiner installed and/or verified the Trusted Build 
for each system component. A primary and general election were then run using EMS, ICX- 
Classic and Prime, ICP and ICC. Results were then tabulated and validated against expected 
results. The Functional Examiner performed the Source Code and Documentation Review 
before the witnessed examination. 

C. Examination Results 

Democracy Suite 5.5 Functional Examination 

On November 17, 2018, the Functional Examiner issued his draft report for the 
testing of Democracy Suite 5.5 with a recommendation that the system was not in 
compliance with Section 1107-A(10) and (15), 25 P.S. §§ 3031.7(10) & (15), of the 
Pennsylvania Election Code. The report noted the following concerns: 

1) The ICX BMD did not allow the user to cast a “no vote” in a contest after voting 
straight party without exiting the straight party option. The system behavior was 
not intuitive enough for the user to understand and did not adequately 
communicate to the voter what they needed to do to accomplish their vote intent. 

2) The ICX BMD indicated to the voter that they were casting their ballot even 
though the ballot was only being printed for scanning and tabulation on ICP or 
ICC. 

The Functional Examiner’s report indicated successful completion of tests executed 
to ascertain compliance to all other requirements mandated by the Pennsylvania Election 
Code. The Examiner report for Democracy Suite 5.5 (Test Report - PDV-003-FTR-01) 
included details of the test cases, execution and successful completion. The following 
section is a summary of the results of the examination as set forth in fuller detail in the 
Examiner's Report. 
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1 . 


Source Code Review 


Source Code Review for Democracy Suite 5.5 was performed, with a focus on 
determining whether any vulnerabilities could be found. The Functional Examiner reported 
that the code review was completed with no malicious software, cryptographic software, 
process control or password management vulnerabilities being found. The Examiner 
concluded that no deficiencies were found during source code review. 

2. Documentation Review 

The Documentation Review testing performed by the Eunctional Examiner 
demonstrated that the Democracy Suite 5.5 meets the relevant requirements of the 
Pennsylvania Election Code. The Examiner reviewed the “Test Report for EAC 2005 VVSG 
Certification Testing of Dominion Democracy Suite 5.5 Voting System” 

The review of the EAC test reports by the Eunctional Examiner and the EAC 
certifications submitted by Dominion satisfy the requirements of Section 1105-A(a) of the 
Election Code, 25 P.S.§ 3031.5(a): requiring that an electronic voting system has been 
examined and approved by a federally recognized independent testing authority (ITA), or 
VSTL as such authorities are now called, as meeting the applicable performance and test 
standards established by the federal government. 

Eunctional Examiner concluded that the design requirements of Sections 1107-A(11) 
and (14) of the Pennsylvania Election Code, 25 P.S. § 3031.7(11) & (14), are met by the 
combination of EAC hardware Non-Operating Environmental Tests, which included bench 
handling, vibration, low temperature, high temperature, humidity and product safety tests. 
The system accuracy testing during EAC certification testing provided confirmation of 
system accuracy as required by Section 1107-A(11) of the Pennsylvania Election Code, 25 
P.S. §3031.7(11). 

The Eunctional Examiner reviewed the system summative usability test report 
submitted to EAC to ascertain compliance to the usability requirement of Section 1107- 
A(15) of the Pennsylvania Election Code, 25 P.S. § 3031.7(15). The review determined that 
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the system documentation provided met EAC criteria for usability^. 


Accuracy testing performed during EAC certification testing provided confirmation 
of system accuracy to ascertain compliance to Section 1107-A(13) of the Pennsylvania 
Election Code, 25 P.S. § 3031.7(13). Additional testing to ensure system accuracy in 
tabulating PA specific voting scenarios was done during the Primary and General Election 
runs. 


3. System Level Testing 

As set forth in the examination approach, System Level Testing was divided into two 
separate tests, a closed primary election and a general election. The ballots defined had 
contests with voting variations supported in Pennsylvania. 

A closed primary election consisting of two political parties (Republican, 
Democratic), three precincts Precinct 1, Precinct 2 - split into Precinct 2a and 2b, Precinct 3, 
was run utilizing EMS, ICX (Classic and Prime), ICP and ICC (two scanners). Eor the 
Republican ballot, there were 21 contests: 19 partisan contests and 2 referendums, 10 “Vote 
for One”, 1 “Vote for no more than Two”, 3 “Vote for no more than Three”, 4 “Vote for no 
more than Four” and 1 “Vote for no more than Fifteen”. For the Democratic ballot, there 
were 21 contests: 19 partisan contests and 2 referendums, 11 “Vote for One”, 1 “Vote for no 
more than Two”, 1 “Vote for no more than Three”, 5 “Vote for no more than Four” and 1 
“Vote for no more than Fifteen”. Referendum contests were added to test the generation of 
non-partisan ballots. The Functional Examiner validated compliance of the system to 
Sections 1101-A and 1107-A(2), (5)-(ll) and (13), 25 P.S. §§ 3031.1, 3031.7(2), (5)-(ll) & 
(13). All test cases passed without anomalies. 

A general election consisting of four political parties (Republican, Democratic, 

Green and Libertarian), three precincts (Precinct 1, a split precinct 2, consisting of splits 2a 
and 2b, Precinct 3)), and 21 contests (19 partisan contests and 2 retentions, 11 “Vote for 


^ The Functional Examiner, however, further identified during Usability Analysis that the system did not 
comply with Section 1107-A(15) of the Pennsylvania Election Code, 25 P.S. § 3031.7(15). 
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One”, 1 “Vote for no more than Two”, 5 “Vote for no more than Three”, 1 “Vote for no 
more than Four” and 1 “Vote for no more than Fifteen”) was run utilizing EMS, ICX 
(Classic and Prime), ICP and ICC (two scanners). The Functional Examiner examined the 
compliance of the system to Sections 1101-A and 1107-A(2)-(8), (lO)-(ll) and (13), 25 P.S. 
§§ 3031.1, 3031.7(2)-(8), (lO)-(ll) & (13). All test cases except those validating 25 P.S. § 
3031.7(10) passed without anomalies. 

Functional Examiner included test cases to validate Sections 1107-A(16) and (17), 

25 P.S. § 3031.7(16) & (17), that mandate voting systems to generate zero proof reports and 
correctly handle over-votes during the election runs. The remainder of the requirements of 
25 P.S. § 3031.7(16) and (17) were validated by the Functional Examiner during the 
Security/Penetration Analysis. 

Election definitions for both primary and general elections were created within EMS- 
EED, and transport media was created to populate ICP, ICX and ICC. Polls were opened 
and ballots were marked manually, as well as electronically via the ballot marking devices ICX 
(Prime and Classic). Ballots were tabulated utilizing the ICP and ICC (Canon DR-GII30 and 
Canon DR-MI60-II) scanners. 

The Functional Examiner used English and Spanish ballots for the test. Reports were 
generated after closing polls and results were validated against expected results. Each 
specific hardware and software component was tested for compliance with the required 
sections of the Election Code. 

The Democracy Suite 5.5 is a paper based system and paper ballots provide a 
permanent physical record of each vote cast adhering to Section llOl-A(l) of the Election 
Code, 25 P.S. § 3031.1. Hand-marked paper ballots and ballots marked electronically using 
ICX are tabulated when voters insert the ballots into the ICP polling place scanner or when 
the ballots are tabulated at the central location using ICC. 

The primary and general election definitions were created using EMS-EED and 
loaded to polling place devices and central scanners, which provided assurance that the 
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system can perform ballot creation activities. The Functional Examiner successfully added 
contests including straight party, parties, choices, precincts, districts, ballot styles, referendum 
questions and retention contests with appropriate candidates and choices. Media was created 
to load the election to ICP, ICX (Classic and Prime) and ICC. The ICP and ICX (Classic and 
Prime) components of the Democracy Suite 5.5 successfully permitted votes for "1 of 1," "N 
of M," and "Question" contests for a standard and ADA voting session. The test cases also 
included straight party voting to confirm that all appropriate candidates were selected. The 
Functional Examiner thus concluded that the system is in compliance with Section 1107- 
A(2), 25 P.S. § 3031.7(2). 

Each of the applicable components of Democracy Suite 5.5 allowed the test voter to 
cast votes for candidates on the ballot and also a write-in vote, demonstrating compliance 
with Section 1107-A(5), 25 P.S. § 3031.7(5). 

Democracy Suite 5.5 meets the requirements for Section 1107-A(6), 25 P.S. § 
3031.7(6), because the test voters cast votes on different ballot styles for candidates and 
questions and the ICX (Classic and Prime) displayed only contests for which the voter was 
entitled to vote. 

The system’s compliance to Section 1107-A(7), 25 P.S. § 3031.7(7), was 
demonstrated since ICP has the capability to indicate overvotes for any office and the voter 
has the ability to either spoil the ballot or cast the ballot with overvotes if the voter decides 
to do so. Ballot marking device ICX (Classic and Prime) did not allow overvotes. The 
Functional Examiner also noted that the system allowed undervotes, but warned the user 
about the undervote if configured to do so. 

The successful validation of the election results showed that ICC as well as precinct 
tabulator ICP include the capability to reject all choices recorded on the ballot for an office 
or question if the number of choices exceeds the number for which the voter is entitled to 
vote, adhering to Section 1107-A(8), 25 P.S. § 3031.7(8). 

The Democracy Suite 5.5 complies with Section 1107-A(9), 25 P.S. § 3031.7(9), 
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because test voters in the closed primary election were only able to vote for referendum 
questions and candidates seeking the nomination of their party. 

The Functional Examiner validated adherence to Section 1107-A(10), 25 P.S. § 
3031.7(10), for both ADA and standard voting sessions. Ballot marking device ICX 
(Classic and Prime) allowed the voters to review their ballots before printing for 
tabulation on ICP or ICC. The Functional Examiner attempted to change votes on ICX 
(Classic and Prime) for candidates within the contest, as well as after leaving the contest 
and then returning to other contests and while reviewing the summary screen. The tests 
demonstrated that ICX allowed changing the selections until the voter decides to print 
the ballot. The Functional Examiner noted that the system did not intuitively allow the 
voter to deselect all candidates in a contest after voting straight party. The BMD, ICX 
(Prime and Classic), also showed a message to the voter that they were casting the ballot 
even though the ballots were being printed to be scanned and tabulated on the ICP or 
ICC. The ICP, precinct scanner of Democracy Suite 5.5 provides the voter with a caution 
message when the ballot contains errors, such as overvotes or undervotes. The voter is also 
presented an error report on the screen when the tabulator detects potential errors. The voter 
can either decide to affirm their intent by casting the ballot, or spoil the ballot and fill out 
another ballot. 

Accuracy requirements of 1107-A(11), 25 P.S. § 3031.7(11), previously ascertained 
by reviewing FAC test reports were further validated by the successful tabulation and 
validation of the primary and general elections run by the Functional Examiner. 

The Functional Examiner validated via test cases during the primary and general 
election that the tabulating devices ICP and ICC generated zero proof reports only before 
ballots were cast, the system rejected all votes for the contest in an overvote situation, and 
produced a results report when appropriately configured, as required under Sections 1107- 
A(16) and (17), 25 P.S. § 3031.7(16) & (17). The Functional Examiner confirmed that the 
zero-proof report cannot be generated on demand after a ballot is cast. 

Ballots were marked by hand including write-in votes during the general election to 
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examine the system’s ability to properly enaet the PA method of straight party voting. The 
ICP, ICC and ICX (Classic and Prime) demonstrated compliance to Sections 1107-A(3) and 
(4), 25 P.S. § 3031.7(3) & (4). The ballot marking devices allowed marking ballots 
following the PA method and the scanners/tabulators appropriately tabulated ballots with 
PA method test scenarios. 

The voting variations used for the examination included write-in votes, to ensure that 
all components of the system will identify the appropriate write-ins and allow the election 
official to tabulate all votes including write-in votes. 

4. Security/Penetration Analysis 

The Functional Examiner adopted a strategy to review each pertinent requirement for 
this test individually and then created test cases to address it in either a documentation 
review, a functional test, or both. 

Precinct tabulation devices and ballot marking devices were configured for delivery 
to a polling place from warehouse including all seals and locks recommended by the 
manufacturer. The central scanners were configured for operation in a county office. The 
devices were inspected for the ability to be tampered with. The Functional Examiner 
examined the polling place equipment to confirm the following: 

■ Adequate seals and locks are present to prevent tampering, and the system provides 
noticeable evidence if any tamper attempt (successful or failed) occurs (ICP, ICX - Classic 
and Prime); 

■ There is no access to the ballots/ballot cards, either via printer, the ICP or ballot card stock, 
to tamper or substitute any ballots (processed, unprocessed, challenged or provisional) 
(ICP, ICX - Classis and Prime); 

■ Devices are not accessible to unauthorized personnel to programmatically tamper with the 
device that would affect ballot presentation, print, or any other feature/activity (ICX - 
Classic and Prime); 
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■ Devices not accessible to unauthorized personnel to programmatically tamper with the 
device that would affect ballot processing, delivery to ballot box, or any other 
feature/activity (ICX - Classic and Prime and ICP); and 

■ The Ballot box is tamper proof and/or tamper evident. 

The Functional Examiner physically examined the central count equipment ICC for 
ballot security procedures, and verification of the system adequately preventing the 
tampering and substitution of ballots. 

The Functional Examiner also examined the components of the Democracy Suite 5.5 
system for password management of administrative functions and ensured that the system 
counter could not be reset by unauthorized persons. In addition, the Functional Examiner 
also reviewed Dominion System Documentation for ballot security procedures at the polling 
place and central location to ensure that the manufacturer recommended the required steps 
for configuring the Democracy Suite 5.5 securely for Election. Based on the tests the 
Functional Examiner concluded that that the system complies to 1107-A(12), 25 P.S. § 
3031.7(12). 

The Functional Examiner included test cases during the Security/Penetration analysis 
phase of the testing to evaluate the security requirements mandated by Setionll07-A(16) 
and (17), 25 P.S. § 3031.7(16) & (17). The Functional Examiner validated that the polling 
place tabulation device, the ICP, had a visible public counter and the system prevented 
authorized and unauthorized users access to vote data while polls are open. Tests were 
completed to verify that USB ports do not allow any data or information to be transferred to 
the ICP and no maintenance, poll worker or administrator accessible screens allow 
tampering with the tabulating element. The system did not allow polls to be opened without 
running a zero-proof report and the content of zero-proof report showed that all candidate 
positions, each question and the public counter were all set to zero. The functionality of the 
system to generate the close of polls report was verified and the report contents were 
analyzed to ensure that it contained the total number of ballots tabulated and total number of 
votes for each candidate and question on the ballot. Based on the above tests and the test 
cases executed while running the elections, the Functional Examiner concluded that 
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Democracy Suite 5.5 complies with all requirements mandated by 25 P.S. §§ 3031.7(16) and 
(17). 


5. Privacy Analysis 

The Functional Examiner reviewed and inspected the privacy aspects of the 
Democracy Suite 5.5 system to determine compliance with Section 1107-A(1) of the 
Election Code, 25 P.S. § 3031.7(1). The Eunctional Examiner determined that the 
components of the system used at the polling place comply with 25 P.S. § 3031.7(1) by 
review of system documentation and physical inspection. Central scanners were physically 
examined by the Examiner for adequate visual secrecy. The Eunctional Examiner also 
verified that no voter data, including stored ballot images are tied back to any specific voter, 
in a manner that would compromise voter secrecy. 

6. Usability Analysis 

The Eunctional Examiner determined that Democracy Suite 5.5 demonstrated 
compliance with the usability requirements of Section 1107-A(14) of the Election Code, 25 
P.S. § 3031.7(14) , by reviewing appropriate EAC certification reports and vendor 
documentation. The Examiner determined that the ICX (Classic and Prime) BMD did not 
comply with the requirements of Section 1107-A(15) of the Election Code, 25 P.S. § 
3031.7(15), since the system did not allow the user to cast a “no vote” in a contest after 
voting straight party without exiting the straight party option. The system behavior was not 
intuitive enough for the user to understand and did not adequately communicate to the voter 
what they needed to do to accomplish their vote intent. Additionally, the ICX-BMD 
informed the voter that they are “casting” their vote even though the ballot was only being 
printed for scanning and tabulation on ICP or ICC. 

Democracy Suite 5.5 Accessibility Examination 

The tests included examiner review, and sessions with voters and poll workers. A 
summary of the test details and findings is discussed in this section. 
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Examiner Review 


The Accessibility Examiner conducted a review of the voting system under 
examination prior to sessions with voters and poll workers. The Accessibility Examination 
team included both accessibility and usability expertise to ensure background and 
knowledge of the issues for accessible voting. The Accessibility Examiner had experience 
working with people with a wide variety of disabilities and their impact on daily life, 
knowledge of the range and use of assistive technologies that voters with disabilities might 
rely on for access, experience conducting usability evaluations with voters and strong 
knowledge of best practices and design principles for digital technology and voting systems. 
The expert review gave the examiners a chance to make sure they understand how the 
system and accessibility features works and to note anything they want to watch for during 
other testing. 

Voter Sessions 

The following voter population was represented in the test sessions: 

• 4 blind from birth 

• 1 late onset blindness 

• 1 dexterity/limited use of hands 

Age Ranges: 35 thru 70. All but one (a 70-year old) were in the 35-60-year- 
old age range. 

Counties: Allegheny, Dauphin, Lebanon, Philadelphia, or York 

Voters had a range of voting experiences. The Accessibility Examiner noted 
that the test population included a limited range of disabilities and the top 
problems with the ICX and ICP machines largely focused on issues a low or 
no vision voter would experience. 
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Poll worker Sessions 


Poll workers were invited to come in teams. We had a total of fourteen 
participants across five sessions, which represented poll workers in Perry and 
Dauphin counties. The poll worker groups: 

• Had between five and twenty-six years of experience. 

• Had at least one election judge 

• Were experienced with the Danaher ELECTronic 1242 and the ES&S 
iVotronic systems 

• Had mostly limited experience serving voters with disabilities. 

Unique facts about the poll worker groups: 

• Three poll workers had blind family members 

• One poll worker was blind 

• One poll worker was a retired user interface designer 


The Accessibility Examiner noted that poll workers with a wider range of 
voting system experience and different sized communities would have provided a better 
sample size for the test. 

The Accessibility Examiner compiled the findings from the examiner review, voter 
sessions and poll worker sessions into positives, annoyances, problem solving, needs 
assistance and likely to prevent independent voting for voters with some disabilities. The 
Accessibility Examiner included recommendations for improving the accessible voting 
experience with each of the top five accessibility issues identified. The report also included 
recommendations on how election officials can support voters and poll workers when the 
new system is fielded. This section presents a summary of the report. Attachment B of this 
document lists these issues and recommendations in fuller detail and also describes all the 
observations from the Accessibility Examination. 

The Accessibility Examiner noted in the summary section of the report that the 
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Dominion systems are an advance in independence and privacy for Pennsylvania voters with 
disabilities, and identified several positive aspects of the system including the following: 

• Voters could vote privately and independently. 

• Access features were easily learned by voters and poll workers, and poll 
workers reported the features would help their voters. 

• Sufficient default text size for all sighted voters and the ability to increase 
to a larger font, if desired. 

• Visual interface is clean and generally intuitive. 

• Printed ballots could easily be read by app-based screen readers 

The top five accessibility issues identified by Accessibility Examiner and voters are 
summarized in the following section. The Department further evaluated each of the findings 
and recommendations from the Accessibility Examiner and included the fielding 
recommendations as conditions for certification of the systemS. The Department also 
discussed the findings from the Accessibility testing, specifically the ones that were marked 
as “Likely to prevent independent voting for voters with some disabilities” to ensure that 
appropriate fielding recommendations would alleviate the concerns for most voters. 

Top 5 Accessibility Issues: 

Privacy and independence restrictions - 

• Poll workers must create a special voter card and initialize the assistive 
devices for voters. This means voters have to disclose disabilities to poll 
workers or poll workers have to guess voter’s abilities. 

• The large ICX touchscreen and placement inside the voting booth may make 
it possible for other voters and people in the polling location to see how the 


^Examples of conditions for certification can be found in this report at identification numbers B, R, T, U, 
V, FF and GG which relate to the top five accessibility issues found during the examination findings. 
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voter is voting, unless the county mitigates this risk when configuring the 
polling place. 

Assistive technologies quality, instructions, and feedback - 

• For the ICX audio, one voice provides voting instructions and the other 
announces ballot content. These appeared to use different technologies. Initially, 
there was a dramatic volume difference between the two, but the vendor was 
able to correct this problem. The rate of speech is different for the two voices, 
and the content voice is difficult to understand at very slow or high speeds 
because of how the audio playback managed the speed. 

• The tactile keypad has duplicated buttons and a help button that is not helpful. 

• The voting instructions are persistent and repetitive, with poor phrasing that 
makes it difficult for voters to understand. Lastly, the content of the instructions 
is too wordy, confusing, and ultimately unhelpful. Voters found it easier to 
ignore the instructions. 

Write-in process 

• The write-in process was difficult for the blind voters, and each required some 
facilitator aid to successfully finish. 

• For voters using the audio assistance, there are no instructions to help a voter 
edit and verify their write-in. 

Silent/Hidden selection and deselection 

• The implementation of the straight party option made candidate selection and 
deselection confusing for some voters. 

• When candidates overrode their straight party vote in a longer contest, 
candidates could be deselected off screen and out of the voter’s view, without 
any system alert. 

• Overvote protections on the system greys out the remaining options once the 
maximum number of selections are reached. This may cause the voter using the 
audio ballot to not hear all of the options in a contest. 
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Paper ballot handling 

• The scanner bed is very shallow and cannot support the entire ballot, and if the 
ballot is not inserted properly, the scanner will return it to the voter. Since the 
scanner bed is not full size, the ballot may fall on the floor. 

• There are no audible cues to assist blind voters, and the scanner screen is not 
easy to see. 

• Contest alerts used on the paper ballots are not used or worded differently on the 
touchscreen device. 

• The Accessibility Examiner noted that paper ballot is printed on cardstock and 
can be read by personal assistive devices. It was noted that the system uses a 
COTS printer for printing the ballots and the voters need not handle blank 
ballots before making the choices. The implementation reduces the verifiability 
for voters using assistive devices, since the ballot cannot be reinserted to be 
“read back”. Three out of the five blind voters were able to use app-based print 
readers to read the ballot back to them. 

• There are no audible cues on the ICP to assist blind voters, and the scanner 
screen is not easy to see. 

The Accessibility Examiner noted that both test voters and poll workers stressed the 
need for a strong education program to introduce the new systems, including opportunities 
for hands on training or practice as a new system is rolled out. The examination team also 
stressed the need for well thought out deployment of any new voting machines 
(recommendations listed in Attachment B) and effective poll worker training. 

Democracy Suite 5.5 Security Examination 

As mentioned in the Examination Approach section of this document, the Security 
Examiner defined the Security Testing to be comprised of a series of test suites which are 
utilized for verifying that a voting system will correspond to applicable security 
requirements within the Pennsylvania Election Code. The examiner analyzed the test results 
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and summarized any identified deficiencies into 4 major categories: documentation, source 
code, hardware, and functional. The Security Examiner then evaluated the physical and 
logical security, software hardening and control measures in place and identified items that 
required remediation before the system is certified for use in Pennsylvania. 

The security testing identified the need to modify the hardening procedures for EMS 
and the ICX BMD printer for a more secure installation. The examiner also provided 
recommendations on secure implementation and deployment. 

Democracy Suite 5.5A Examination Results 

Democracy Suite 5.5A Functional Examination 

As identified in the test approach section of this document the follow-up examination 
of Democracy Suite 5.5A included Documentation Review, Source Code Review and 
System Level Testing and Usability Analysis. 

1. Documentation Review 

The Examiner reviewed the draft “Test Report for EAC 2005 VVSG Certification 
Testing Dominion Voting Solutions Democracy Suite 5.5A voting system”. The review 
confirmed that the Dominion Democracy Suite 5.5A has been evaluated to federal standards 
by a VSTL. Democracy Suite 5.5A was provided the initial certification decision by EAC 
on December 20, 2018, which serves as an acknowledgement by EAC that the system has 
successfully completed conformance testing to VVSG 1.0, and hence complies with Section 
1105-A(a) of the Election Code, 25 P.S.§ 3031.5(a), which requires that a voting system 
must be examined and approved by a federally recognized independent testing authority 
(ITA), or VSTL as such authorities are now called. 

2. Source Code Review 

A Source Code Review for the code modifications for Democracy Suite 5.5A was 
performed, with a focus on determining whether any vulnerabilities could be found that 
would warrant additional testing. The Eunctional Examiner concluded that no vulnerabilities 
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were found during source code review that would warrant additional testing. 

3. System Level Testing 

The System Level Testing was divided into two tests, a primary election and general 
election. The Functional Examiner included test cases to specifically test the PA method 
anomalies identified during Democracy Suite 5.5 testing as part of the general election. 

A closed primary election consisting of two political parties (Republican, 
Democratic), three precincts (Precinct 1, Precinct 2 - split into Precinct 2a and 2b, Precinct 3 
was run utilizing EMS, ICX (Classic and Prime), ICP and ICC (two scanners - Canon DR- 
G1130 & Canon DR-M160-11). Eor the Republican ballot, there were 21 contests: 19 
partisan contests and 2 referendums, 10 “Vote for One”, 1 “Vote for no more than Two”, 3 
“Vote for no more than Three”, 4 “Vote for no more than Four” and 1 “Vote for no more 
than Fifteen”. For the Democratic ballot, there were 21 contests: 19 partisan contests and 2 
referendums, 11 “Vote for One”, 1 “Vote for no more than Two”, 1 “Vote for no more than 
Three”, 5 “Vote for no more than Four” and 1 “Vote for no more than Fifteen”. 

Referendum contests were added to test the generation of non-partisan ballots. The 
Functional Examiner validated compliance of the system to Sections 1101-A and 1107- 
A(2), (5)-(ll) and (13), 25 P.S. §§ 3031.1, 3031.7(2), (5)-(ll) & (13). No issues or 
anomalies were experienced during these tests, and the objective criteria established in the 
test protocols were met. 

A general election consisting of four political parties (Republican, Democratic, 

Green and Libertarian), three precincts one of which was a split precinct (Precinct 1, split 
precinct 2, consisting of splits 2a and 2b, Precinct 3) , and 21 contests (19 partisan contests, 
and 2 retentions, 11 “Vote for One”, 1 “Vote for no more than Two”, 5 “Vote for no more 
than Three”, 1 “Vote for no more than Four” and 1 “Vote for no more than Fifteen”) was 
run utilizing EMS, ICP, ICX and ICC. The Eunctional Examiner examined the compliance 
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of the system to Sections 1101-A and 1107-A(2)-(8), (lO)-(ll) and (13), 25 P.S. §§ 3031.1, 
3031.7(2)-(8), (lO)-(ll) & (13). 

The Functional Examiner created election definitions and executed appropriate test 
cases on all components of Democracy Suite 5.5A to ensure that the modified system 
satisfies all requirements of the Election Code. The Eunctional Examiner used English and 
Spanish ballots for the test. Reports were generated after closing polls and results were 
validated against expected results. Each specific hardware and software component was 
tested for compliance with the required sections of the Election Code. 

The Eunctional Examiner confirmed with appropriate test cases and voting patterns 
that Democracy Suite 5.5A maintains compliance to Sections 1101-A and 1107-A(2), (4)- 
(11) and (16)-(17), 25 P.S. §§ 3031.1, 3031.7(2), (4)-(ll), (16) & (17), via tests cases in a 
similar manner as done during the Democracy Suite 5.5 examination. The Eunctional 
Examiner validated that the issues identified during the examination of Democracy Suite 5.5 
are resolved and demonstrated compliance to Section 1107-A(10), 25 P.S. § 3031.7(10). 

4. Usability Analysis 

The Eunctional Examiner validated that the usability issues on the ICX BMD noted 
during the Dominion Democracy Suite 5.5A were resolved. The ICX-BMD did not have any 
references to the word “cast” during the printing process. The ICX-BMD displayed a pop up 
message requiring user acknowledgement indicating that the voter has to exit out of the 
straight party option to cast a “no vote” in a contest. The Eunctional Examiner hence 
concluded that the system demonstrated compliance to Section 1107-A(15), 25 P.S. § 
3031.7(15). 

Additional Security/Penetration and Privacy analysis were not conducted during the 
Democracy Suite 5.5A examination since the test cases validated during these tests were not 
affected by the isolated modification done to the ICX-BMD to resolve the anomalies noted 
during the Democracy Suite 5.5 examination. 
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The Functional Examiner also noted that the paper ballots will allow recounts as 
required by Sections 1117-A, 25 P.S. § 3031.17. The Functional Examiner identified that 
the following within Article XI-A of the Pennsylvania Election Code, Sections 1101-A to 
1122-A, 25 P.S. §§ 3031.1 - 3031.22, are not applicable to the current examination, as each 
deal with non-functional testing aspects of acquisition, use and maintenance aspects of a 
voting system: 

• 25 P.S. § 3031.2; 

• 25 P.S. § 3031.3; 

• 25 P.S. § 3031.4; 

• 25 P.S. § 3031.6; 

• 25 P.S. § 3031.8; 

• 25 P.S. § 3031.9; 

• 25 P.S. § 3031.10; 

• 25 P.S. § 3031.11; 

• 25 P.S. § 3031.12; 

• 25 P.S. § 3031.13; 

• 25 P.S. § 3031.14; 

• 25 P.S. § 3031.15; 

• 25 P.S. § 3031.16; 

• 25 P.S. § 3031.18; 

• 25 P.S. § 3031.19; 

• 25 P.S. § 3031.20; 

• 25 P.S. § 3031.21; and 

• 25 P.S. § 3031.22. 


After all the testing activities, the examiners and Department concluded that the 
Democracy Suite 5.5A demonstrates compliance with all requirements as delineated in 
Article XI-A of the Pennsylvania Election Code, Sections 1101-A to 1122-A, 25 P.S. §§ 
3031.1 - 3031.22. The conclusion was drawn based on the examination of Democracy Suite 
5.5Ain conjunction with the Democracy Suite 5.5 examination. 

Democracy Suite 5.5A Security Examination 
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The Security Examiner evaluated the documentation changes made to the system 
hardening procedures and confirmed that if the system is implemented following the 
hardening procedures, it provides a secure implementation. 

D. Observations 

During the examination, and in the review of documentation, the Examiner and/or 
Department staff noted the following observations: 

1. The system presented for examination had undervote warnings turned on for 
straight party contest on ICX (Classic and Prime). This may make the voter believe that there is a 
need to make a selection in that contest. 

2. Observations/Findings from the Accessibility Examination are listed on pages 
32 thru 34 and as Attachment B of this document. 

3. Dominion Democracy Suite 5.5A does not support cumulative voting. 

4. The configuration of the system complying with the Pennsylvania Election Code 
requirements including the PA method of straight party voting will require the use of appropriate 
selections of configurable parameters. 

5. The ADA compliant ballot marking device ICX (Classic and Prime) presented 
as part of the Democracy Suite 5.5A system, could be effectively used by all voters. This allows 
jurisdictions to expand the use of these devices for a larger universe of voters and not restrict 
their use to voters using assistive devices. 

6. The system allows configuration of button labels, warning/alert messages, voter 
instructions etc. There are some configuration elements that can be configured via the EMS 
Graphical User Interface (GUI) while there are some elements like button labels that cannot be 
configured via Graphical User Interface and will need to be done by editing a configuration 
(JSON) file on the EMS server. 

7. The use of voter access cards for activation will create a lot of components to 
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manage and track on Election Day. Creating a large number of voter activation cards prior to 
Election Day would make it difficult to keep track of the card inventory. If jurisdictions choose 
to create cards on demand that would necessitate the need for an additional system at the polling 
place. 


8. The ICX (Classic and Prime) BMDs use a COTS printer for printing marked 
ballots. The printer settings need to be appropriately adjusted for the printed ballots to be read by 
ICP or ICC. 

IV. Conditions for Certification 

Given the results of the examination that occurred in October and December 2018 
and the findings of the Examiners as set forth in their reports, the Secretary of the 
Commonwealth certifies the Democracy Suite 5.5A subject to the following conditions: 

A. This certification for Democracy Suite 5.5A is based on the EAC initial 
certification decision dated December 20, 2018, and will be appended with the final EAC 
certification documentation after the final EAC certification is issued."^ Any jurisdictions 
purchasing and implementing the system before the final EAC certification must perform a 
trusted build validation after the final EAC certification to ensure that the certified system 
components are installed. This validation must happen even if the jurisdiction has done a 
trusted build validation during the system acceptance. 

B. Pennsylvania counties using the Democracy Suite 5.5A must comply with the 
Directive Concerning the Use, Implementation and Operations of Electronic Voting Systems 
by the County Boards of Elections issued by the Secretary of the Commonwealth on June 9, 
2011, and any future revisions or directives. In particular, Pennsylvania counties must 
adhere to item four (4) of the directive when setting up and positioning the ICX in the 


This certification is being issued due to the unique circumstances of the federal government 
shutdown after the successful initial certification decision was issued by the EAC and notice was 
given that no further testing is necessary. Consequently, only ministerial documentation remains, 
which will be appended once issued. 
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polling place to assure compliance with the constitutional and statutory requirements that 
secrecy in voting be preserved (see Pa. Const Art. VII § 4; and Section II07-A(1) of the 
Election Code, 25 P.S. § 3031.7(1)). The ICX (Classic and Prime) screens have large size 
and high-resolution display and are very clear and can be viewed at wide angles without 
distortion. Jurisdictions must make a note of this while setting up polling places and 
purchase privacy booths. 

C. No components of the Democracy Suite 5.5 A shall be connected to any 
modem or network interface, including the Internet, at any time, except when a standalone 
local area wired network configuration in which all connected devices are certified voting 
system components. Transmission of unofficial results can be accomplished by writing 
results to media, and moving the media to a different computer that may be connected to a 
network. Any wireless access points in the district components of Democracy Suite 5.5A, 
including wireless LAN cards, network adapters, etc. must be uninstalled or disabled prior 
to delivery or upon delivery of the voting equipment to a county board of elections. 

D. Because Democracy Suite 5.5A is a paper-based system, counties using the 
Democracy Suite 5.5A must comply at a minimum with Section 1117-A of the Election 
Code, 25 P.S. § 3031.17, that requires a "statistical recount of a random sample of ballots 
after each election using manual, mechanical or electronic devices of a type different than 
those used for the specific election." This audit must be conducted via a manual count of 
the voter marked paper ballots exclusively. Counties must include in the sample ballots 
marked by ADA compliant components. Counties are advised to consult the Directive 
Concerning the Use, Implementation and Operations of Electronic Voting Systems by the 
County Boards of Elections issued by the Secretary of the Commonwealth on June 9, 2011 
and any future revisions or directives that may apply to audits of electronic voting systems. 

E. All jurisdictions implementing the Democracy Suite 5.5A need to carry out a 
full Logic and Accuracy test on each device without fail and maintain evidence of Logic and 
Accuracy (L&A) testing in accordance with the statutory requirements for pre-election and 
post-election testing. Jurisdictions must include audio ballots and accessible devices during 
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L&A testing. The Department does not recommend automated L&A testing, and 
discourages the use of preprinted ballots provided by vendors. All components being used 
on election day, including any Electronic Poll Books being used, must be part of the L&A 
testing. Counties must ensure that the L&A test cases include all applicable scenarios of the 
PA straight party method identified in Attachment C to the Directive for electronic voting 
systems published by BCEL on September 11,2017. 

L. Democracy Suite 5.5A is a paper-based system and hence, implementation of 

the system for precinct or central count scanning is scalable. Jurisdictions should calculate 
the number of voting booths necessary to accommodate the number of registered voters in a 
precinct to avoid long lines. Jurisdictions must include the ICX as an ADA compliant 
device in configuring a precinct polling place. Jurisdictions must also take into consideration 
the ICP scanning speed, ballot box and Transport Media capacities on polling place 
components when deciding on the number of voting booths. 

G. All jurisdictions implementing the Democracy Suite 5.5A must implement 
administrative safeguards and proper chain of custody to facilitate the safety and security of 
electronic systems pursuant to the Guidance on electronic Voting System Preparation and 
Security, September 2016. 

H. Jurisdictions implementing the Democracy Suite 5.5A with the Central Count 
Tabulator as the primary system, where votes are counted only at the central counting 
location using central scanners, must comply with Section 301(a) of Help America Vote Act 
of 2002. The mandate requires counties using central count paper-based systems to develop 
voting system specific voter education programs that inform voters of the effect of over 
voting, and instruct voters on how to correct a ballot before it is cast, including instructions 
on obtaining a replacement ballot. Additionally, the mandate requires that the central count 
voting system must be designed to preserve voter confidentiality. 

I. All jurisdictions implementing the Democracy Suite 5.5A must ensure that no 
default passwords are used on any devices and that all passwords are complex and secured. 
Counties must implement an audit process to review and ensure that no default passwords are 
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used upon equipment install/reinstall and routinely change passwords to avoid any password 
compromise. The passwords and permissions management must at a minimum comply to the 
password requirements outlined in NIST 800-63. This publication can be accessed at 
https://pages.nist.gOv/800-63-3/sp800-63-3.html. 

J. All jurisdictions implementing Democracy Suite 5.5A must configure the polling 
place components of the voting system to notify voter on overvotes. 

K. All jurisdictions implementing Democracy Suite 5.5A must work with Dominion 
to ensure that only the certified system configuration is installed on purchase or anytime a 
system component is replaced or upgraded. Jurisdictions must as part of their user acceptance 
test verify the implementation to ensure that the components, software and firmware belong to 
the certified system. Jurisdictions must also perform a trusted build validation as part of the 
election preparation activities and post-election canvass activities utilizing the vendor supplied 
methods of validation and verification of voting system integrity. A sample format that can be 
used for the attestation is added as Attachment C to this document. 

L. Dominion must work with the jurisdictions implementing Democracy Suite 5.5A 
to ensure that the system has been hardened for a secure implementation. Jurisdictions must 
implement processes to ensure that all components of the voting system have been hardened per 
the instructions in the TDP. 

M. Jurisdictions can make use of the adjudication functionality to adjudicate 
write-ins and evaluate questionable ballots, contests or selections to determine voter intent. 
Any decisions made during review of the ballot must be agreed upon by a team of at least 
two reviewers authorized by the election official. The election official can also consult the 
paper ballot to assist with determinations made during adjudication. In the event of a 
recount, the voter verified paper ballots must be used for the count. 

N. Jurisdictions implementing Democracy Suite 5.5A must work with Dominion 
to ensure that the implemented configuration is capable of operating for a period of at least 
two hours on backup power as required by the VVSG. If the system components don’t 
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include internal battery packs for reliable power, the Uninterruptible Power Supply (UPS) 
specified in the EAC certified configuration must be purchased and used at the polling 
places. 


O. Jurisdictions using the services of Dominion or a third-party vendor for 
election preparation activities must work with Dominion or the vendor to ensure that 
systems used for ballot definition activities are considered part of the voting system and use 
certified voting system components. The systems used for ballot definition must be 
configured securely following conditions outlined in this report and following any 
Directives and Guidance issued by the Secretary. Any data transfer between the vendor and 
county must be done using encrypted physical media or secure file transfer process. The file 
transfer and download must be tracked and audited to make sure that data has not been 
accessed by unauthorized personnel. 

P. Jurisdictions must implement processes and procedures involving 
management, monitoring and verification of seals, locks/keys, before, during and after the 
election. 

Q. Jurisdictions must not use individual voter access cards for activating the ICX 
Ballot Marking device. This is to avoid lost, stolen or misplaced cards with the activator 
chip, which would be a potential vulnerability. Jurisdictions using poll worker cards for ICX 
activation must ensure that poll workers are trained to maintain strict chain of custody of the 
activation card. 

R. Dominion must ensure that any implementations in Pennsylvania counties 
must appropriately indicate that the ICX BMD is printing the ballot and the final messaging 
on the ICX must instruct the voter on how to complete the voting process. Any references to 
“casting the ballot” must not be present. The changes must be done during implementation 
by Dominion support personnel and verified by county election officials. 

S. Jurisdictions must have appropriate instructions on the ICX BMD to ensure 
that the voter reviews the entire ballot before printing the ballot. This is to avoid voters 
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missing selections in contests, especially after voting straight party. 


T. Jurisdictions must work with Dominion to ensure that the entire audio ballot 
including audio rates and volumes on the audio ballot are tested before deploying to polling 
places. Jurisdictions must also ensure that poll worker training includes potential situations 
and questions from voters using the audio ballot. This is specifically important for 
Dominion Democracy Suite 5.5A. Jurisdictions must note that the general instructions and 
ballot instructions are configured separately and could have different volume setting and 
audio rates. This was noted during the Accessibility Examination and made the audio ballot 
almost unusable before adjusting the volume settings. Specific attention must be given to 
ensure that the audio ballots are tested by multiple personnel to evaluate the voice quality 
and the instruction accuracy. 

U. Jurisdictions must work with Dominion during the ballot definition to ensure 
that voters using assistive devices have clear instructions for the write-in process. The on¬ 
screen instructions must be adjusted to have the audio ballot explain the process. The audio 
instructions must include instructions on how to navigate and find the write-in keyboard. 

V. Jurisdictions must work with Dominion to thoroughly test and review audio 
ballot instructions to ensure that the voters using an audio ballot can cast the ballot without 
requesting assistance. Jurisdictions must consider the following while reviewing the ballot: 

• The audio ballot must fully inform the voter what has happened on the system 
and how to select/deselect their choices; 

• The feedback messages must explain to voters what is happening, including 
the number and names of candidates being deselected; and 

• The audio ballot must provide feedback on the reason for the changes in any 
selections and the interaction with straight-party choices. 

W. Jurisdictions must make voters aware that voting straight party is optional via 
clear instructions on paper, on screen and audio ballots. This is to ensure that the voter 
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doesn’t assume that he/she must make a seleetion for the straight party eontest. The ballot 
instructions must be approved by the Department and follow any directives and/or guidance 
issued by the Department. Jurisdictions must also ensure during the election definition 
process that the straight party contest is excluded from undervote warnings. This is to ensure 
that the voter doesn’t assume that he/she must make a selection for the straight party contest. 

X. Dominion must ensure that the COTS printer used for ICX BMD (HP 
LaserJet Pro Printer M402dn /HP LaserJet Pro Printer M402dne) must be configured to 
ensure that the printer settings cannot be changed by the voter at the polling place. The 
configuration must ensure that the printer settings can only be modified by authorized 
personnel. 

Y. The electronic voting system must be physically secured while in transit, 
storage, or while in use at their respective locations. Unmonitored physical access to 
devices can lead to compromise, tampering, and/or planned attacks. 

Z. Jurisdictions must implement processes and procedures involving 
management, monitoring and verification of seals, locks/keys, before, during and after the 
election. 

AA. Jurisdictions must seal any unused ports on the voting system components 
using tamper evident seals even if the port is inside a locked compartment. Jurisdictions 
must work with Dominion and use physical port blocking plugs to close unused ports 
whenever possible before placing the tamper evident seal. The Department also 
recommends using port blocking plugs for exposed ports for components of the voting 
system housed in county office that can be removed by authorized personnel when the port 
is needed. 

BB. Jurisdictions using standalone installation of the EMS server on portable 
devices must protect the laptops to prevent lost or stolen device. 

CC. Jurisdictions must implement processes to gather and safekeep system logs 
for each component of the voting system after each election. Consistent auditing of system 
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logs and reports is vital to maintain system transparency and to ensure that any compromise 
or malfunction is observed and reported in a timely manner. 

DD. Jurisdictions implementing Democracy Suite 5.5A must ensure that the USB 
devices and any other removable or transportable media used for election activities is 
maintained with strict chain of custody. There must be a process to manage the 
removable/transportable media inventory to avoid misplaced and lost media. The devices 
must either be replaced or reformatted before use in each election. Appropriate steps must 
be taken to ensure that the format is a full reformat of the USB devices. 

EE. Jurisdictions implementing Democracy Suite 5.5A must work with Dominion 
to ensure appropriate levels of training for election officials is planned on implementation. 
Counties must ensure that the trainings adhere to the “Minimum Training Requirements” 
specified in Attachment D of this document. 

EE. Jurisdictions implementing Democracy Suite 5.5A must include voter and 
poll worker training as part of the implementation plan. The training must include hands on 
practice for both voters and poll workers. Specific consideration must be given to voters 
using assistive devices and also poll worker education to assist voters with disabilities. Refer 
to Attachment B, listing detailed recommendations for deployment noted by the 
Accessibility Examiner. 

GG. Jurisdictions implementing Democracy Suite 5.5A must consider the 
following during voting booth set up for serving voters requiring assistive devices 

o Voters with disabilities may have assistive technology or personal notes that 
they need to place within reach. They may also need room to place the printed 
ballot on a flat surface to use personal technology such as magnifiers or text 
readers to verify it. 

o The path between ICX and the ICP should be as easy as possible, ideally a 
straight line with no obstructions. The path should include ample room to turn 
a wheelchair if the machine is positioned with the screen facing the wall. The 
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ADA standards suggest a minimum of 60x60 inches for this. 


o The cords for tactile keypads, headphones and BMD printer need to be placed 
so that they don’t interfere with the printed ballot and the voter’s ability to 
find and take the ballot. 

Refer to Attachment B, listing detailed recommendations for deployment noted by 
the Accessibility Examiner. 

HH. Jurisdictions implementing Democracy Suite 5.5A must ensure that the 
iButton used for activating administrative access on ICP is managed with strict chain of 
custody. The iButton pass codes must be modified at a minimum for every election. If an 
iButton pass code requires change after the initial assignment, appropriate EMS options 
must be selected to ensure that only the latest assigned iButton pass code is active. 

II. Dominion must submit the following system education materials to the 
Department of State and must consent to the publication and use of the video on any 
websites hosted by any Pennsylvania counties and the Pennsylvania Secretary of the 
Commonwealth or publicly available social media platform. The videos must have audio 
instructions and must be closed captioned. 

o A video (in an electronic format) for voters that demonstrates how to cast a 
vote using the Voting System. 

o A video (in an electronic format) for precinct election officials that 
demonstrates how to setup, operate, and shutdown the Voting System 
components on an Election Day. The video must demonstrate how to set up 
and operate the voting system accessible devices for use by voters. 

o A “quick reference guide” for precinct election officials to consult on Election 
Day. The guide must be specific to the purchasing county’s setup and use of 
the Voting System including accessible options. 

o A “quick reference guide” with images that demonstrates to voters how to cast 
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a vote. Must be provided in additional languages for any jurisdictions required 
to meet thresholds in the Voting Rights Act. 

JJ. Dominion must adhere to the following reporting requirements and submit the 
following to the Secretary: 

o Equipment Reporting. Reported field issues or anomalies that occur in 
Pennsylvania or elsewhere with any piece of equipment deployed in the 
Commonwealth of Pennsylvania within 3 days of the occurrence; 

o Advisory Notices. System advisory notices issued for any piece of equipment 
deployed in the Commonwealth of Pennsylvania regardless of whether the 
incident behind the notice occurred in Pennsylvania; 

o Ownership, Financing, Employees, Hosting Location. Any changes of 
information on the Supplier’s employees and affiliates, locations, company 
size and ability to provide technical support simultaneously to several 
counties in the Commonwealth of Pennsylvania and other jurisdictions that 
use its Voting System. Additionally, Dominion must provide information on 
foreign ownership/financing, data hosting, and production for any equipment 
or ancillary products, including any potential conflict of interest that may have 
developed for employees and affiliates; 

o Security Measures and any updated security testing or risk/vulnerability 
assessments conducted by the Supplier or a third-party; and 

o SOC 2 Reporting - Dominion shall provide the Secretary with its annual 
American Institute of Certified Public Accountants (AICPA) Attestation 
Standard (AT) Sec. 101 Service Organization Control (“SOC”) 2, Type 2 
certification (AT Sec. 101 SOC 2, Type 2), or an equivalent certification 
approved by the Commonwealth. Equivalent certifications include, but are not 
limited to: International Organization of Standards (ISO) 2700x certification; 
certification under the Federal Information Security Management Act 
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(FISMA); and AT Sec. 101 SOC 3 (SysTrust/WebTrust) certification. 


KK. Dominion must adhere to the “Source Code and Escrow Items Obligations” 
specified in Attachment E of this document. In addition, Dominion must provide a copy of 
the source code on a password protected CD to the Secretary. 

LL. Dominion must work with jurisdictions to ensure that the system is configured 
to comply with all applicable requirements of PA Election Code delineated in Section 
Article Xl-A of the Pennsylvania Election Code, sections 1101-A to 1122-A, 25 P.S. §§ 
3031.1 -3031.22. 

MM. Jurisdictions implementing the Democracy Suite 5.5A and Dominion must 
work together to implement system under this certification and must comply with the 
conditions found in this report, and any directives issued by the Secretary of the 
Commonwealth regarding the use of this System, in accordance with Section 1105-A(a)-(b) 
of the Election Code, 25 P.S. § 3031.5(a)-(b). Dominion must ensure that future releases of 
the voting system with enhanced security and accessibility features are presented for 
approval to the Secretary. 

NN. Dominion must work with counties and Department to ensure that the system 
can integrate with the Pennsylvania Depart of State’s Election Night Reporting (ENR) 
system. In addition, pursuant to the Directive on Electronic Voting Systems issued by the 
Secretary of the Commonwealth on August 8, 2006, the Directive Concerning the Use, 
Implementation and Operation of Electronic Voting Systems by the County Boards of 
Elections issued on June 9, 2011 and section 1105-A(d) of the Pennsylvania Election Code, 
25 P.S. § 3031.5(d), this certification and approval is valid only for Democracy Suite 5.5A. 

If the vendor or a County Board of Elections makes any changes to the Democracy Suite 
5.5A Voting System subsequent to the date of its examination, it must immediately notify 
both the Pennsylvania Department of State and the relevant federal testing authority or 
laboratory, or their successors. Eailure to do so may result in the decertification of the 
Democracy Suite 5.5A Voting System in the Commonwealth of Pennsylvania. 
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V. 


Recommendations 


A. All jurisdictions implementing Democracy Suite 5.5A Voting System should 
ensure that the system is correctly set up pursuant to all the recommendations of the Directive 
Concerning the Use, Implementation and Operations of Electronic Voting Systems by the 
County Boards of Elections issued by the Secretary of the Commonwealth on June 9, 2011 and 
Guidance on Electronic Voting System Preparation and Security, September 2016. 

B. All jurisdictions implementing Democracy Suite 5.5A should take appropriate 
steps to ensure that voter education is part of the implementation plan. 

C. All jurisdictions implementing the Democracy Suite 5.5A should ensure that 
precinct election officials and poll workers receive appropriate training and are comfortable 
using the system. 

D. All jurisdictions considering purchase of the Democracy Suite 5.5A should 
review the System Eimits as mentioned in the EAC certification scope. 

E. The Secretary recommends that Dominion and counties work with the 
Department on any changes to their voting equipment including, but not limited to, purchase and 
upgrades. 

F. Secretary recommends in-house ballot definition activities at county location 
whenever possible. If an external vendor location is used the county should implement checks 
and balances to ensure that election data including ballot definition files and audit logs stored on 
devices outside of the county is protected from unauthorized access. 

G. Secretary recommends configuring the election with only one contest being 
displayed on each screen presented to the voter on ICX. This is to ensure that all screens 
presented to the voter are similar and voters don’t need to adapt to the situation that there may be 
multiple contests displayed on a screen. 
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VI. Conclusion 


As a result of the examination, and after consultation with the Department's staff and 
the Examiners, the Secretary of the Commonwealth concludes that the Democracy Suite 
5.5A can be safely used by voters at elections as provided in the Pennsylvania Election Code 
and meets all of the requirements set forth in the Code, provided the voting system is 
implemented with the conditions listed in Section IV of this report . Accordingly, the 
Secretary certifies Democracy Suite 5.5A for use in this Commonwealth. 

The ICX can accommodate 4 to 5 voters using assistive devices per hour or around 
19 voters per hour when used as the primary voting system depending on the size of the 
ballot. The ICP precinct scanner can serve 30 voters per hour depending on the length of the 
ballot. 
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Attachment A - EAC Certification Scope^ 


mi 

CertConf&Scope_D 

Suite5.5-A.pdf 


^ Certification scope added on February 01, 2019 after final EAC certification was granted. Also corrected 
the version number of ImageCast X on page #7 to read 5.5.10.30. 
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United States Election Assistance Commission 


Certificate of Conformance 


Dominion Voting Systems 
Democracy Suite 5.5-A 



VVSG 2005 VER. I 



CERTIFIED 



The voting system identified on this certificate has been evaluated at an accredited voting system testing la¬ 
boratory for conformance to the Voluntary Voting System Guidelines Version 1.0 (WSG 1.0) . Components 
evaluated for this certification are detailed in the attached Scope of Certification document. This certificate 
applies only to the specific version and release of the product in its evaluated configuration. The evaluation 
has been verified by the EAC in accordance with the provisions of the EAC Voting System Testing and Cer- 
tiGcation Program Manual and the conclusions of the testing laboratory in the test report are consistent with 
the evidence adduced. This certificate is not an endorsement of the product by any agency of the U.S. Gov¬ 
ernment and no warranty of the product is either expressed or implied. 


Product Name: Democracy Suite 


Model or Version: 5.5-A 


Name ofVSTL: SLI Compliance 


EAC Certification Number: DVS-DemSuite5.5-A 


Date Issued: January 30, 2019 



Executive Director 
Scope of Certification Attached 





















Manufacturer: Dom/n/on Voting Systems (DVS) 
System Name: Democracy Suite 5.5-A 
Certificate: DVS-DemSuite5.5-A 


Laboratory: 5/./ Compliance 
Standard: VVSG 1.0 (2005) 
Date: January 30, 2019 



Scope of Certification 


This document describes the scope of the validation and certification of the system defined 
above. Any use, configuration changes, revision changes, additions or subtractions from the 
described system are not included in this evaluation. 

Significance of EAC Certification 

An EAC certification is an official recognition that a voting system (in a specific configuration or 
configurations) has been tested to and has met an identified set of Federal voting system 
standards. An EAC certification is not: 

• An endorsement of a Manufacturer, voting system, or any of the system's components. 

• A Federal warranty of the voting system or any of its components. 

• A determination that a voting system, when fielded, will be operated in a manner that 
meets all HAVA requirements. 

• A substitute for State or local certification and testing. 

• A determination that the system is ready for use in an election. 

• A determination that any particular component of a certified system is itself certified for 
use outside the certified configuration. 

Representation of EAC Certification 

Manufacturers may not represent or imply that a voting system is certified unless it has 
received a Certificate of Conformance for that system. Statements regarding EAC certification in 
brochures, on Web sites, on displays, and in advertising/sales literature must be made solely in 
reference to specific systems. Any action by a Manufacturer to suggest EAC endorsement of its 
product or organization is strictly prohibited and may result in a Manufacturer's suspension or 
other action pursuant to Federal civil and criminal law. 

System Overview: 

The D-Suite 5.5-A Voting System is a paper-based optical scan voting system with a hybrid 
paper/DRE option consisting of the following major components: The Election Management 
System (EMS), the ImageCast Central (ICC), the ImageCast Precinct (ICP), and the ImageCast X 
ballot marking device (BMD). The D-Suite 5.5-A Voting System configuration is a modification 
from the EAC approved D-Suite 5.5 system configuration. 
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Language capability: 

System supports Alaska Native, Apache, Bengali, Chinese, English, Eskimo, Filipino, French, 
Hindi, Japanese, Jicarilla, Keres, Khmer, Korean, Navajo, Seminole, Spanish, Thai, Towa, Ute, 
Vietnamese, and Yuman. 

Democracy Suite 5.5-A System Diagram 


DEMOCRACY SUITE* - System High-Level Block Diagram ^ 
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Components Included: 

This section provides information describing the components and revision level of the primary 
components included in this Certification. 


Voting System Software Components: 


System Component 

Software or 

Firmware Version 

Operating System or COTS 

Comments 

EMS Election Event Designer (EED) 

5.5.12.1 

Windows 10 Pro 

EMS 

EMS Results Tally and Reporting (RTR) 

5.5.12.1 

Windows 10 Pro 

EMS 

EMS Application Server 

5.5.12.1 

Windows Server 2012 R2 

Windows 10 Pro 

EMS 

EMS File System Service (FSS) 

5.5.12.1 

Window 10 Pro 

EMS 

EMS Audio Studio (AS) 

5.5.12.1 

Windows 10 Pro 

EMS 

EMS Data Center Manager (DCM) 

5.5.12.1 

Windows Server 2012 R2 

Windows 10 Pro 

EMS 

EMS Election Data Translator (EDT) 

5.5.12.1 

Windows 10 Pro 

EMS 

ImageCast Voter Activation (ICVA) 

5.5.12.1 

Windows 10 Pro 

EMS 

EMS Adjudication (ADJ) 

5.5.8.1 

Windows 10 Pro 

EMS 

EMS Adjudication Services 

5.5.8.1 

Windows 10 Pro 

EMS 

Smart Card Flelper Service (SCFIS) 

5.5.12.1 

Windows 10 Pro 

EMS 

Election Firmware 

5.5.3-0002 

uClinux 

ICP 

Firmware Updater 

5.5.3-0002 

uClinux 

ICP 

Firmware Extractor 

5.5.3-0002 

uClinux 

ICP 

Kernel (uClinux) 

5.5.3-0002 

Modified COTS 

ICP 

Boot Loader (COLILO) 

20040221 

Modified COTS 

ICP 

Asymmetric Key Generator 

5.5.3-0002 

uClinux 

ICP 

Asymmetric Key Exchange Utility 

5.5.3-0002 

uClinux 

ICP 

Firmware Extractor (Technician Key) 

5.5.3-0002 

uClinux 

ICP 

ImageCast Central Application 

5.5.3.0002 

Windows 10 Pro 

ICC 

ICX Application 

5.5.10.30 

Android 5.1 (ICX Prime) 

ICX 


Voting System Platform: 


System Component 

Version 

Operating System or 
COTS 

Comments 

Microsoft Windows Server 

2012 R2 Standard 

Unmodified COTS 

EMS Server SW 
Component 

Microsoft Windows 

10 Professional 

Unmodified COTS 

EMS Client/server 
SW Component 

.NET Framework 

3.5 

Unmodified COTS 

EMS Client/server 
SW Component 

Microsoft Visual J# 

2.0 

Unmodified COTS 

EMS Client/server 
SW Component 

Microsoft Visual C++ 2013 Redistributable 

2013 

Unmodified COTS 

EMS Client/server 
SW Component 

Microsoft Visual C++ 2015 Redistributable 

2015 

Unmodified COTS 

EMS Client/server 
SW Component 

Java Runtime Environment 

7u80 

Unmodified COTS 

EMS Client/server 
SW Component 

Java Runtime Environment 

8ul44 

Unmodified COTS 

EMS Client/server 
SW Component 
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System Component 

Version 

Qperating System or 
CQTS 

Comments 

Microsoft SQL Server 2016Standard 

2016 Standard 

Unmodified CQTS 

EMS Client/server 
SW Component 

Microsoft SQL Server 201 Service Pack 2 

2016 SPl 

Unmodified CQTS 

EMS Client/server 
SW Component 

Microsoft SQL Server 2016 SPl Express 

2016 SPl 

Unmodified CQTS 

EMS Client/server 
SW Component 

Cepstral Voices 

6.2.3.801 

Unmodified CQTS 

EMS Client/server 
SW Component 

Arial Narrow Fonts 

2.37a 

Unmodified CQTS 

EMS Client/server 
SW Component 

Maxim iButton Driver 

4.05 

Unmodified CQTS 

EMS Client/server 
SW Component 

Adobe Reader DC 

AcrobatDC 

Unmodified CQTS 

EMS Client/server 
SW Component 

Microsoft Access Database Engine 

2010 

Unmodified CQTS 

EMS Client/server 
SW Component 

Qpen XML SDK 2.0 for Microsoft Qffice 

2.0 

Unmodified CQTS 

EMS Client/server 
SW Component 

Infragistics NetAdvantage Win Forms 

2011.1 

2011 Vol. 1 

Unmodified CQTS 

EMS SW Platform 

Infragistics NetAdvantage WPF 2012.1 

2012 Vol. 1 

Unmodified CQTS 

EMS SW Platform 

TX Text Control Library for .NET 

16.0 

Unmodified CQTS 

EMS SW Platform 

SQX 

14.3.1 

Unmodified CQTS 

EMS SW Platform 

NLog 

1.0.0.505 

Unmodified CQTS 

EMS SW Platform 

iTextSharp 

5.0.5 

Unmodified CQTS 

EMS SW Platform 

QpenSSL 

1.0.2K 

Unmodified CQTS 

EMS SW Platform 

QpenSSL FIPS Qbject Module 

2.0.14 (Cert 1747) 

Unmodified CQTS 

EMS SW Platform 

SQLite 

1.0.103.0 

Unmodified CQTS 

EMS SW Platform 

Lame 

3.99.4 

Unmodified CQTS 

EMS SW Platform 

Speex 

1.0.4 

Unmodified CQTS 

EMS SW Platform 

Ghostscript 

9.04 

Unmodified CQTS 

EMS SW Platform 

Qne Wire API for .NET 

4.0.2.0 

Unmodified CQTS 

EMS SW Platform 

Avalon-framework-cvs-20020806 

20020806 

Unmodified CQTS 

EMS SW Platform 

Batik 

0.20-5 

Unmodified CQTS 

EMS SW Platform 

Fop 

0.20-5 

Unmodified CQTS 

EMS SW Platform 

Microsoft Visual J# 2.0 Redistributable 
Package-Second Edition (x64) 

2.0 

Unmodified CQTS 

EMS SW Platform 

Entity framework 

6.1.3 

Unmodified CQTS 

EMS SW Platform 

Spreadsheetlight 

3.4.3 

Unmodified CQTS 

EMS SW Platform 

Qpen XML SDK 2.0 for Microsoft Qffice 

2.0.5022.0 

Unmodified CQTS 

EMS SW Platform 

Qpen SSL 

1.0.2K 

Unmodified CQTS 

ICP 

QpenSSL FIPS Qbject Module 

2.0.10 (Cert 1747) 

Unmodified CQTS 

ICP 

Zlib 

1.2.3 

Unmodified CQTS 

ICP 

uClinux 

20070130 

Modified CQTS 

ICP 

Google Text-to-Speech Engine 

3.11.12 

Unmodified CQTS 

ICX SW 

Zxing Barcode Scanner 

4.7.5 

Modified CQTS 

ICX SW 

SoundTouch 

1.9.2 

Modified CQTS 

ICX SW 

ICX Prime Android 5.1.1 Image 

0405 

Modified CQTS 

ICX SW 

ICX Classic Android 4.4.4 Image 

0.0.98 

Modified CQTS 

ICX SW 

QpenSSL FIPS Qbject Module 

2.0.10 (Cert 2473) 

Unmodified CQTS 

ICX SW Build 
Library 
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System Component 

Version 

Operating System or 
COTS 

Comments 

OpenSSL 

1.0.2K 

Unmodified COTS 

ICC SW Build 
Library 

OpenSSL FIPS Object Module 

2.0.10 (Cert 1747) 

Unmodified COTS 

ICC SW Build 
Library 

1-Wire Driver (x86) 

4.05 

Unmodified COTS 

ICC Runtime SW 

1-Wire Driver (x64) 

4.05 

Unmodified COTS 

ICC Runtime SW 

Canon DR-G1130 Driver 

1.2 SP6 

Unmodified COTS 

ICC Runtime SW 

Canon DR-G1130 TWAIN Driver 

1.2 SP6 

Unmodified COTS 

ICC Runtime SW 

Visual C-n- 2013 Redistributable (x86) 

12.0.30501 

Unmodified COTS 

ICC Runtime SW 

Machine Configuration File (MCF) 

5.5.10.19_20180706 

Proprietary 

ICX Configuration 
File 

Device Configuration File (DCF) 

5.4.01_20170521 

Proprietary 

ICPand ICC 
Configuration File 


Hardware Components: 


System Component 

Flardware Version 

Proprietary or 
COTS 

Comments 

ImageCast Precinct (ICP) 

PCOS-320C 

Proprietary 

Flybrid Precinct 
Scanner/DRE 

ImageCast Precinct (ICP) 

PCOS-320A 

Proprietary 

Flybrid Precinct 
Scanner/DRE 

ICP Ballot Box 

BOX-330A 

Proprietary 

Ballot Box 

ICP Ballot Box 

BOX-340C 

Proprietary 

Ballot Box 

ICP Ballot Box 

BOX-341C 

Proprietary 

Ballot Box 

ICX UPS Inline EMI Filter 

1.0 

Proprietary 

EMI Filter 

ICX Tablet (Classic) 

aValue 21" Tablet (SID-21V) 

COTS 

Ballot Marking Device 

ICX Tablet (Prime) 

aValue 21" Tablet (HID-21V) 

COTS 

Ballot Marking Device 

Server 

Dell PowerEdge R630 

COTS 

Standard Server 

Server 

Dell PowerEdge R640 

COTS 

Standard Server 

Server 

Dell Precision T3420 

COTS 

Express Server 

ICC Workstation FIW 

Dell OptiPlex 7440 All in One 

COTS 


ICC Workstation FIW 

Dell OptiPlex 9030 All In One 

COTS 


ICC Workstation FIW 

Dell OptiPlex 3050 All In One 

COTS 


ICC Scanner 

Canon imageFormula DR-G1130 

COTS 

Central Count Scanner 

ICC Scanner 

Canon imageFormula DR-M160II 

COTS 

Central Count Scanner 

Client Workstation FIW 

Dell Precision T3420 

COTS 


Client Workstation FIW 

Dell Latitude E7450 

COTS 


Client Workstation FIW 

Dell Latitude e3480 

COTS 


ICX Printer 

FIP LaserJet Pro Printer M402dn 

COTS 


ICX Printer 

FIP LaserJet Pro Printer M402dne 

COTS 


Monitor 

Dell Monitor KM632 

COTS 


Monitor 

Dell Monitor P2414Flb 

COTS 


Monitor 

Dell Ultrasharp 24" Monitor U2414FI 

COTS 


CD/DVD Reader 

Dell DVD Multi Recorder GP60NB60 

COTS 


iButton Programmer 

Maxim iButton Programmer 
DS9490R# with DS1402 

COTS 


UPS 

APC Smart-UPS SMT1500 

COTS 


Network Switch 

Dell X1008 

COTS 


Network Switch 

Dell X1018 

COTS 
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System Component 

Hardware Version 

Proprietary or 
COTS 

Comments 

Network Switch 

Dell X1026 

COTS 


Network Switch 

Dell PowerConnect 2808 

COTS 


Sip and Puff 

Enabling Devices Sip and Puff 

COTS 


Headphones 

Cyber Acoustics ACM-70 

COTS 


4-way Joystick Controller 

S26 

Modified COTS 


Rocker (Paddle) Switch 

Enablemart #88906 

COTS 


Footswitches 

ABLENET Jelly Bean Twist 10033400 

COTS 


CF Card Reader 

lOGEAR SDHC/microSDHC 
0U51USC410 

COTS 


CF Card Dual-Slot Reader 

Lexar USB 3.0 

COTS 


CF Card Reader 

Hoodman Steel USB 3.0 102015 

COTS 


CF Card Reader 

Lexar Professional CFRl 

COTS 


CF Card Reader 

Kingston FCR-HS4 

COTS 


ATI 

ATI handset 

Proprietary 


ATI 

ATI-USB handset 

Proprietary 


ACS PC-Linked 

Smart Card Reader 

ACR39U 

COTS 



System Limitations 

This table depicts the limits the system has been tested and certified to meet. 


Characteristic 

Limiting 

Component 

Limit 

Comment 

Ballot positions 

Ballot 

292*/462** 

Both 

Precincts in an election 

EMS 

1000; 250 

Standard; Express 

Contests in an election 

EMS 

1000; 250 

Standard; Express 

Candidates/Counters in an election 

EMS 

10000; 2500 

Standard; Express 

Candidates/Counters in a precinct 

Ballot 

240*/462** 

Both 

Candidates/Counters in a tabulator 

Tabulator 

10000;2500 

Standard; Express 

Ballot Styles in an election 

Tabulator 

3000; 750 

Standard; Express 

Ballot IDs in a tabulator 

Tabulator 

200 

Both 

Contests in a ballot style 

Ballot 

38*/156** 

Both 

Candidates in a contest 

Ballot 

240*/231** 

Both 

Ballot styles in a precinct 

Tabulator 

5 

Both 

Number of political parties 

Tabulator 

30 

Both 

"vote for" in a contest 

Ballot 

24*/30** 

Both 

Supported languages in an election 

Tabulator 

5 

Both 

Number of write-ins 

Ballot 

24*/462** 

Both 


* Reflects the system limit for a ballot printed in landscape. 
** Reflects the system limit for a ballot printed in portrait. 
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Functionality 

2005 WSG Supported Functionality Declaration 


Feature/Characteristic 

Yes/No 

Comment 

Voter Verified Paper Audit Trails 



VVPAT 

NO 


Accessibility 



Forward Approach 

YES 


Parallel (Side) Approach 

YES 


Closed Primary 



Primary: Closed 

YES 


Open Primary 



Primary: Open Standard (provide definition of how supported) 

YES 


Primary: Open Blanket (provide definition of how supported) 

YES 


Partisan & Non-Partisan: 



Partisan & Non-Partisan: Vote for 1 of N race 

YES 


Partisan & Non-Partisan: Multi-member ("vote for N of M") board races 

YES 


Partisan & Non-Partisan: "vote for 1" race with a single candidate and 
write-in voting 

YES 


Partisan & Non-Partisan "vote for 1" race with no declared candidates 

and write-in voting 

YES 


Write-In Voting: 



Write-in Voting: System default is a voting position identified for write- 

ins. 

YES 


Write-in Voting: Without selecting a write in position. 

NO 


Write-in: With No Declared Candidates 

YES 


Write-in: Identification of write-ins for resolution at central count 

YES 


Primary Presidential Delegation Nominations & Slates: 



Primary Presidential Delegation Nominations: Displayed delegate slates 
for each presidential party 

YES 


Slate & Group Voting: one selection votes the slate. 

YES 


Ballot Rotation: 



Rotation of Names within an Office; define all supported rotation 
methods for location on the ballot and vote tabulation/reporting 

YES 

Equal time rotation 

Straight Party Voting: 



Straight Party: A single selection for partisan races in a general election 

YES 


Straight Party: Vote for each candidate individually 

YES 


Straight Party: Modify straight party selections with crossover votes 

YES 


Straight Party: A race without a candidate for one party 

YES 


Straight Party: "N of M race (where "N">1) 

YES 


Straight Party: Excludes a partisan contest from the straight party 

selection 

YES 


Cross-Party Endorsement: 



Cross party endorsements, multiple parties endorse one candidate. 

YES 


Split Precincts: 



Split Precincts: Multiple ballot styles 

YES 
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Feature/Characteristic 

Yes/No 

Comment 

Split Precincts: P & M system support splits with correct contests and 
ballot identification of each split 

YES 


Split Precincts: DRE matches voter to all applicable races. 

YES 


Split Precincts: Reporting of voter counts (# of voters) to the precinct split 
level; Reporting of vote totals is to the precinct level 

YES 


Vote N of M: 



Vote for N of M: Counts each selected candidate, if the maximum is not 

exceeded. 

YES 


Vote for N of M: Invalidates all candidates in an overvote (paper) 

YES 


Recall Issues, with options: 



Recall Issues with Options: Simple Yes/No with separate race/election. 
(Vote Yes or No Question) 

YES 


Recall Issues with Options: Retain is the first option. Replacement 
candidate for the second or more options (Vote 1 of M) 

NO 


Recall Issues with Options: Two contests with access to a second contest 
conditional upon a specific vote in contest one. (Must vote Yes to vote in 
2"*^ contest.) 

NO 


Recall Issues with Options: Two contests with access to a second contest 
conditional upon any vote in contest one. (Must vote Yes to vote in 2"'* 
contest.) 

NO 


Cumulative Voting 



Cumulative Voting: Voters are permitted to cast, as many votes as there 

are seats to be filled for one or more candidates. Voters are not limited 

to giving only one vote to a candidate. Instead, they can put multiple 

votes on one or more candidate. 

NO 


Ranked Order Voting 



Ranked Order Voting: Voters can write in a ranked vote. 

NO 


Ranked Order Voting: A ballot stops being counting when all ranked 

choices have been eliminated 

NO 


Ranked Order Voting: A ballot with a skipped rank counts the vote for the 

next rank. 

NO 


Ranked Order Voting: Voters rank candidates in a contest in order of 
choice. A candidate receiving a majority of the first choice votes wins. If 
no candidate receives a majority of first choice votes, the last place 
candidate is deleted, each ballot cast for the deleted candidate counts for 
the second choice candidate listed on the ballot. The process of 
eliminating the last place candidate and recounting the ballots continues 
until one candidate receives a majority of the vote 

NO 


Ranked Order Voting: A ballot with two choices ranked the same, stops 
being counted at the point of two similarly ranked choices. 

NO 


Ranked Order Voting: The total number of votes for two or more 

candidates with the least votes is less than the votes of the candidate 

with the next highest number of votes, the candidates with the least 
votes are eliminated simultaneously and their votes transferred to the 
next-ranked continuing candidate. 

NO 
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Feature/Characteristic 

Yes/No 

Comment 

Provisional or Challenged Ballots 



Provisional/Challenged Ballots: A voted provisional ballots is identified 
but not included in the tabulation, but can be added in the central count. 

YES 


Provisional/Challenged Ballots: A voted provisional ballots is included in 
the tabulation, but is identified and can be subtracted in the central 

count 

NO 


Provisional/Challenged Ballots: Provisional ballots maintain the secrecy of 

the ballot. 

YES 


Overvotes (must support for specific type of voting system) 



Overvotes: P & M: Overvote invalidates the vote. Define how overvotes 

are counted. 

YES 

Overvotes cause a 

warning to the voter 
and can be configured 

to allow voter to 

override. 

Overvotes: DRE: Prevented from or requires correction of overvoting. 

YES 


Overvotes: If a system does not prevent overvotes, it must count them. 

Define how overvotes are counted. 

YES 

If allowed via voter 

override, overvotes are 
tallied separately. 

Overvotes: DRE systems that provide a method to data enter absentee 

votes must account for overvotes. 

N/A 


Undervotes 



Undervotes: System counts undervotes cast for accounting purposes 

YES 


Blank Ballots 



Totally Blank Ballots: Any blank ballot alert is tested. 

YES 

Precinct voters receive 

a warning; both 
precinct and central 

scanners will warn on 

blank ballots. 

Totally Blank Ballots: If blank ballots are not immediately processed, 
there must be a provision to recognize and accept them 

YES 

Blank ballots are 

flagged. These ballots 
can be manually 

examined and then be 

scanned and accepted 
as blank; or precinct 

voter can override and 

accept. 

Totally Blank Ballots: If operators can access a blank ballot, there must be 
a provision for resolution. 

YES 

Operators can examine 
a blank ballot, re-mark 
if needed and allowed, 

and then re-scan it. 

Networking 



Wide Area Network - Use of Modems 

NO 


Wide Area Network - Use of Wireless 

NO 


Local Area Network - Use of TCP/IP 

YES 

Client/server only 

Local Area Network - Use of Infrared 

NO 
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Feature/Characteristic 

Yes/No 

Comment 

Local Area Network - Use of Wireless 

NO 


FIPS 140-2 validated cryptographic module 

YES 


Used as (if applicable): 



Precinct counting device 

YES 

ImageCast Precinct 

Central counting device 

YES 

ImageCast Central 


Baseline Certification Engineering Change Orders [ECO] 

There are no ECOs applied to this modification that are not certified as part of the baseline Democracy Suite 5.5 
voting system. 
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Attachment B - Accessibility Examination Findings and Recommendations 


A) Top problems and Recommendations as listed in the accessibility examiner’s report 



Top problems - 
Dominion.pdf 


B) All observations from Accessibility Examination 


oa 

All 

observations.pdf 


C) Other Recommendations for Deployment from Accessibility Examiner report 


iza 

Other issues and 
recommendations fc 


D) Top positives 



Top positives - 
Dominion.pdf 


54 



Top problems 

The following discusses the problems that surfaced during the expert 
examinations and voter/poll worker observations with the Dominion Voting 
ICX ballot marking system. 

Testing identified five problems that could reduce the ability of people with 
disabilities to vote independently and privately on the ICX voting machine. 

1. Privacy and Independence 

What Happened? 

The ICX voting system, as it was configured during certification testing, 
presents two impediments to voters with disabilities voting privately and 
independently. 

• Machine set up. The ICX has a 27-inch, portrait oriented diagonal 
display, which is very large and produces very clear print. Also, as 
with most modern displays, the screen can be viewed at wide angles 
without distortion. Also, the machine and printer take up a sizable 
operating footprint. Which means in most voting booths, the screen 
will sit near the front of the booth in order to fit. 

• Voter check-in and disclosure. With the ICX system, voters receive a 
voter "smart card" from the check-in table that contains all the 
information the machine needs to pull up the correct ballot. There 
are many ways a county could implement this system, but it was clear 
that a card would need to be created for each voter in advance or on 
demand. There were two types of voter cards: standard and 
accessibility devices enabled. The second type of card must be 
inserted by a poll worker to activate the accessibility device options 
screen, where the preferred device, such as the tactile keypad, switch 
input, or audible output is chosen. Then, the preferred device is given 
to the voter. 

• Accommodation screen. The accommodation selection screen is 
available only once in the voting process, so it is not possible to try 
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different accommodations to see which would work best. And, once 
the voter has begun voting, they cannot change the type of 
accommodation without canceling the ballot and starting again. 


o Really only two options. The accommodation screen presents 
four choices: Audio-Tactile Interface (ATI), Paddles, Sip and 
Puff, or Audio/Visual mode. While this suggests that there are 
four modes of interaction, there are, in fact, only two. The ATI, 
Paddles, and Sip and Puff selections produce identical 
behavior. The Paddles and Sip and Puff choices, from the 
point of view of the voting machine, are identical, as would be 
any user-provided switch input. In all three methods, the 
machines "listens" for input from the switches and provides 
auditory feedback. In the fourth choice, AudioA/isual mode, 
the system provides auditory navigation and feedback, but 
does not listen for switch input. 

o Active touchscreen, all the time. In all four modes, the 

touch-screen remains active. When the voter touches a control 
for the first time, its purpose and content is announced, but 
not selected. A second touch selects the control and activates 
it (if a button). On second touch, the content of the choice is 
repeated aloud, which allows a voter with low-vision to explore 
the screen by touching various controls and hearing their 
function without accidentally making choices. 

This behavior for various switch and audio modes is not well 
implemented. A person who elects to use the switch input will 
not touch the screen for control, as that is beyond their 
capability (hence the use of the switch interface). However, if a 
switch user needs assistance from another person, the double¬ 
touch function means the poll worker or aide must touch each 
choice twice. In these cases, the two-step selection is an 
unnecessary burden. Since the switch user (blind or sighted) 
would be using a personal listening device such as the 
provided headphones or personal headset, the selected choice 
being read prior to the selection would not be apparent to the 
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person helping, and learning the two-step selection could be 
difficult. 


Why is this a problem? 

The poll worker setup and required voter disclosure are problems for 

three reasons. 

• Bright and clear. Anyone within 10 feet of a booth, including in 
nearby booths, can observe the selections of any voter. 

• Voters cannot independently choose and initiate their 
preferred voting method. For a voter to have access to the 
assistive devices they must declare their need at sign-in, and 
receive a different activation card than that provided to non¬ 
disabled voters. In some cases, such as blindness or mobility 
impairment, the disability is overt, and there is no loss of 
confidentiality. When such a voter enters the polling place, their 
need for accommodation is readily apparent, and there is no 
additional exposure from requesting an accommodations card 
(and generally the assistance of a poll worker in setting up the 
machine). 

Because a poll worker must initiate the accommodations, and 
then walk away, there's no method where the voter could do this 
by themselves and then test the different devices. 

• Social stigma and privacy. There are other types of disability that 
are not readily apparent, and those living with these limitations 
would also benefit from the available accommodations. For 
example, voters with low literacy or cognitive impairment would 
benefit from the audio/visual assistive option, but might not 
understand that the accessibility options can help them vote more 
effectively, or they may not wish to reveal their status to the poll 
workers and the community. The ICX voting machine requires this 
disclosure to activate the accommodations. 
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Recommendations 

The recommendation for the physical privacy concern is relatively 
straightforward. Counties will need to think about how a polling location is 
set up. Keeping the open side of the voting booth close to a wall and 
ensuring adequate clearance around the voting machine can help. Also, 
exploring different voting booth manufacturers and types. One that is 
deeper and allowed the machine to be pushed back into the booth could 
provide enough side-to-side privacy. 

A county choosing this machine will have to do at least two things before 
Election Day to ensure poll workers and voters are successful. 

• Poll Worker accessibility training. Counties can create a poll worker 
accessibility training component that gives poll workers tools to 
effectively help voters with disabilities. Counties that already have 
this type of program can evaluate it against this machine's 
requirements. Such training programs could include ways to identify 
voters who may need assistance, how to appropriately ask a voter if 
they need assistance, and how to assist a voter once identified. 

• Voter education and demonstrations. Officials can create voters 
with disabilities education and demonstration events around the 
county. Here, voters can learn how to use the new machine, and the 
county can demonstrate all the machine's accessibility features. While 
demonstrating them, officials can give examples of who could benefit 
from using each assistive device, and especially include examples of 
voters most would not immediately identify as having a disability. For 
example, an older voter with sight problems might benefit from the 
additional audio instructions. Or a diabetic with neuropathy in their 
hands may prefer to use the dual-switch paddles. Both examples of 
voters may not have known the options and devices were available 
before. 

A strong two-pronged training and education program will help poll workers 
be more comfortable with assisting voters with disabilities. Having who 
know all of the accessibility options and well-trained poll workers will make 
voters feel more comfortable asking for assistance on Election Day. 
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2. Audio Quality, Instructions, and Feedback 

The ICX voting machine had a number of problems with the audio quality, 
instructions, and feedback. 


What happened? 

The ICX machine uses two distinct voices for its audio interface. 

• Instructions. One voice, used for instructions, appears to be 
prerecorded synthesized voice that will remain constant across 
elections. This voice is well articulated and clear, but was considered 
"harsh," "not good," and "rinky-dink" by voters who were more 
experienced with the state-of-the-art voices provided on their 
personal devices. The pacing and phrasing of this voice meant it was 
difficult to know when a sentence started and ended. For a brief 
announcement, this voice would be acceptable, but the long-term use 
was a problem (see below). 

• Ballot content. The second voice uses text-to-speech and reads the 
content of the ballot. Unlike the pre-recorded voice, this voice is "live," 
somewhat "fuzzier," and less harsh than the instructional voice. 

As delivered, these two voices had five problems, one of which was corrected 
before the voters arrived. 

• Volume difference. The first, correctable, issue was that the voices 
started at quite different volumes. When the instructional voice was 
set to a comfortable level, the content voice was nearly inaudible. 

This problem was fixed by an adjustment by the manufacturer, but 
should have been tested before delivery. 

• Rate of speech and voice quality. The system allowed voters to 
change the rate of speech, which is common for audio assistive 
devices. The range of speech rates was very different between the 
two voices. The instructional voice could be slowed by as much as 
50%, and accelerated by approximately 200%. The content voice, by 
contrast, could be sped up by about 600%. An increase in the rate of 
the instructional voice from 100 words per minute to 110 words per 


Accessibility testing of the Dominion ImageCastX System 


21 


minute might result in a change of the content voice from 100 wpm to 
200 words per minute. After the initial orientation to the machine, 
voters were more interested in the information provided by the 
content voice. These two voices need to respond similarly to the 
settings. 

• Audio and tactile keypad. At the top of the keypad, there are 
controls to adjust the rate and volume of the auditory feedback. 

These buttons are convex on top to indicate increasing, or concave to 
indicate decreasing the assigned function. Below this are five buttons: 
a right-left pair, the select button, and an up-down pair. At the 
bottom of the keypad is a "Help" button that reaches from side to 
side. 

On the lower edge of the keypad are ports for headphones or access 
switches. These ports are physically identical (3.5mm phono Jacks), 
and have nearly invisible raised labels (black on black). There is no 
Braille marking on the ports. 

The tactile keypad's navigation buttons do not have a unique function 
in this voting system. 

o The yellow, left and right buttons and the blue, up and down 
buttons do exactly the same thing. During the ATI instructions, 
this was not stated. The instructions described the yellow-and 
blue-buttons as having different functions. At each step, the 
buttons were described by color, shape, and function: "the 
yellow, left-arrow button to move left," or "the blue up-arrow 
button to move up." 

o The single exception to this was the select button. In the Help 
instructions, this was identified as the "red, x-shaped select 
button." However, throughout the audio narration on the 
machine, this was only described as the "red select button." 
Several blind voters commented, "Why do I care what color it 
is?" When it was explained that a person with low vision might 
use this interface, and might be able to use the color as an aid, 
they were accepting, but the select button, being used so 


Accessibility testing of the Dominion ImageCastX System 


22 


often, should have been identified, using this logic, as x-shaped 
rather than simply "red." 

• Persistence and repetition. The phrasing of audio commands 
should place the most important information first. This allows the 
voter to attend when the narration of interest, and think about other 
things when it is not. 

o The same instructions played every time a voter pressed a 
button in the same contest area. The instructions only 
changed when they moved to a new contest area or page. 

Also, if the voter paused to think about the next action, the 
instructions would immediately start to play again. Voters 
stopped thinking about voting to listen to the voice to ensure 
no new information was available. After voters figured out the 
pattern, they stopped listening to the instructions altogether. 

• Instructions content. The content instructions are also long, 
confusing, or unhelpful. 

o The audio instructions for the Dominion system repeatedly 
said "Use the yellow, right-arrow button or the blue down 
arrow button to move to the next item." This long text was 
confusing. More efficient wording might simply ignore one set 
of buttons, for example, "To move to the next item, use the 
blue down-arrow button." 

o The introduction to the write-in screen says that you can write- 
in a candidate of your choice, but does not provide guidance 
on how to do that. This disturbed even the sighted voters, but 
every blind voter had to be cued to move beyond the box 
announced as "Write-in candidate, blank" to find the keyboard. 

Sometimes the voting instructions on the screen are poorly worded. 

o The screen to select a straight party vote, the instructions say 
"You may select the party of your choice by selecting the party 
of your choice." 
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Why is this a problem? 

To some extent, the audio instructions and content feature of the Dominion 
system may suffer from an "uncanny valley" where it is close enough to good 
to be annoying, though it is actually better than the feedback from some of 
the other machines we have evaluated. 

Blind users typically want their text-to-speech voices to speak at rates above 
400 words per minute, so that they can listen at the same rate sighted people 
can read. Many blind individuals read at speeds in excess of 600 words per 
minute, and up to 1000 words per minute (the limit of current technology). 
People with cognitive limitations such as auditory processing disorders may 
need the voice to speak more slowly, to give them time to understand it. 

Voices designed for screen reading do not necessarily sound like human 
voices, but remain understandable over a wide range of speeds. To 
accomplish this, the components of voice that carry information are 
identified, and the filler sounds between those components are stretched or 
shortened to change the overall speech rate without loss of intelligibility. 
People who routinely listen to synthetic voices expect this. 

The voices used in the Dominion voting machine are not this sophisticated. 

To increase speech rate, it appears that they simply slice sections from the 
sound stream. To slow the voice down, they insert silence at intervals in the 
sound stream. This approach is "effective" for compressions and stretches of 
10 to 20%, as the human brain can fill in the blanks fairly effectively. 

However, the Dominion system attempts to use this technique with slowing 
to as little as 50% of the speech rate, and increasing rate by several hundred 
percent. 

The use of two audio voices for instructions and ballot content in and of itself 
is not a problem (in fact, it meets the WSG requirement that they be 
different). But Dominion's implementation of the voices is a problem for at 
least two reasons. 

• Election Day Ready. The ICX seems to have a lot of configuration 
points, which could be a good thing for counties. However, when 
many of the settings, like the disparate volumes between instructions 
and content speech, are not usable out-of-the-box, some counties 
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may not know that they need to make those changes for an option to 
be usable. 

• Cognitive overhead. Voters had to concentrate excessively to 
understand what was being said. At the lower three speed settings, 
the instructional voice was noticeably broken up, and at the highest 
two settings the gaps made it impossible to process what was being 
said. 

When voters have to interpret poorly written instructions, it means 
they are not thinking about voting. This is made harder for voters 
using the audio when the quality, rate, and phrasing mean they are 
spending more time figuring out how to use the machine than they 
are on which candidate is best for the contest. 


Recommendations 

Counties choosing this machine can ensure that they: 

• Test the audio rates and volumes before deployment to make sure 
they are usable for both blind voters and others who might use the 
audio. 

• Train poll workers well on the potential issues and questions voters 
might have about using the audio while voting. 

• Provide community demonstrations so voters can practice with the 
machine. Voting on Election Day may be smoother if they know what 
to expect. 

Also, if the audio style and content is configurable, counties should ask the 
vendor to do the following: 

• Use better voices. Many of the blind voters demonstrated the voices 
they use on their personal assistive devices, and explained why they 
were better. Much better voices than those on the tested system are 
available for purchase or license. The vendor could provide a 
synthetic voice that is designed for high compression levels such as 
those used in commercial screen readers or cell phones. 
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• Include verbosity control and contextual help. The blind voters all 
indicated that they would prefer some verbosity control on the audio 
instructions, or changing the level and wordiness of the help as 
needed. In the initial orientation, the full names could be used. Once 
the voter is oriented, though, this could be contracted to "Use the 
arrows to move forward or back." If the voter got confused, the Help 
button on the ATI could be configured to provide more detailed 
instructions about the current screen. 

3. The Write-In Process 

The write-in screen and process presented two problems for voters using the 
audio assistance. 


What happened? 

When visually choosing to write in a candidate on the ICX, the voter enters 
the write-in screen and is presented with a text box, where the write-in name 
will appear, editing buttons ("Clear all" and "Delete"). Below this is an on¬ 
screen keyboard in alphabetical order to enter the name of the chosen 
candidate. At the bottom of the screen is a button to confirm the write-in 
and return to the ballot. This all makes sense for a sighted voter because the 
layout is clear. 

• No instructions. There were very few instructions for sighted voters, 
but the layout of the screen made use self-explanatory for everyone 
in this test. The audio had no additional instructions beyond "Please 
enter your write in candidate." Then when the voter navigated to the 
next option, they only heard the voice say the text box was empty. 
Voters became caught in this area for a long time. The "Help" button 
on the tactile keypad only gave voters instructions on how to use the 
tactile keypad. 

All of the blind voters needed facilitator assistance to successfully 
write in a candidate. Each voter had trouble moving beyond the write- 
in name box. But once they advanced to, and heard, "A," they rapidly 
and generally accurately typed the name of the write-in candidate. At 
intervals, the users could navigate to the write-in name box to hear 
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their entry spelled back to them, then return to typing. None of our 
blind voters discovered this capability. 

• Editing Problems. The Dominion ICX had implementation problems 
with editing a name once it had been entered and using the audio 
assistance. 

o Deleting. The only option for editing an error in name entry is 
to delete letters or the entire name and start from scratch. For 
sighted voters, this makes sense visually. They can see the 
letters disappearing and can easily see what letters remain. For 
blind voters using the audio, each letter is announced when 
typed, but when deleted, the key announces only "Delete," and 
not what has been deleted. 

o Repeating too soon. If the voter stops to consider what they 
are doing while editing a name, the ICX repeats the last audio 
instruction given. While this is not ordinarily more than an 
annoyance, in text entry it can be challenging. If the name 
being written in has a double letter, and the user pauses to 
think about the spelling of the name, the system will repeat the 
last instruction, "You selected 'M'." If this occurs as the user 
presses the select key to double the "M," it is not clear whether 
a second "M" has been typed, or if the audio has just repeated 
the previous letter. The user must navigate to the name box to 
hear the name spelled out to find out how many letter "Ms" 
have been typed. (This process is not described in the audio 
instructions, and must be discovered by the voter.) 

o Does not voice the "Space." The "space" character between 
names is not voiced. A blind voter may have forgotten to enter 
a space, but would not know. 

o No reentry. True for all voters: If a voter has entered a write-in 
name, returns to the ballot, and then realizes that the name 
was misspelled, touching the write-in option again clears the 
text in the box. 
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Why is this a problem? 

While it is arguable that the write-in process has very little impact in most 
contests, all of our voters and poll workers were very interested in the 
usability of the write-in process. And all functions of a voting machine should 
work effectively for each voter. It does not always have to be the same 
method, but the outcome should be the same. Not being able to effectively 
edit a write-in name is a major problem for two reasons. 

• An entry the voter thought was cast correctly because there were no 
audible mistakes might still be voided because of inaudible errors. 

• Limited instructions combined with editing problems can lead to voter 
confusion. Even if they can figure out a method to get the system to 
voice what is actually in the text box, it takes an inordinate amount of 
mental resources. Resources that some voters cannot spare and 
should be reserved to deciding who to vote for. 

Recommendation 

We recommend the following changes to the write-in system: 

• Adjust the on-screen instructions so that the audio reads it. 

• Include audio instructions how to navigate to find the keyboard. 

• Rework how the system voices deleted characters and the frequency 
it repeats them. 

• Include any and all spaces and special characters in the text box when 
reading the entry to the voter. 

4. Silent/Hidden selection and deselection 

What happened? 

There were three elements of silent and/or hidden selection and de-selection 
on the ICX that voters found confusing. In most cases, voters were able to 
mark their ballot as instructed through trial and error, but in others, they did 
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not notice changes made by the system and might vote in a way that does 
not match their intent. 

• Destructive candidate deselection when changing a straight party 
contest 

After making a straight party choice, if voters wanted to vote for 
additional candidates from another party or "scratch" and change party 
for that contest, the system automatically deselects all of the other pre¬ 
marked candidates. In a contest with a short list of candidates, this 
behavior, dictated by the PA Method, caused confusion, but with 
persistence voters were able to select the candidates specified in the 
instructions. When the voters were asked to vote for just one of the three 
automatically selected candidates, they universally attempted to deselect 
an unwanted candidate by pressing on that candidate's name. Because 
of the interpretation of the PA Method, this resulted in confirming the 
vote for that candidate, instead of deselecting that candidate, as the 
voters stated they had expected. The voters were, in this case where the 
changes were evident, able to correct the error and vote as instructed. 
(Please see more about candidate selection in the next section) 

• When the contest was long, candidates were often de-selected on a 
different screen, with no notification from the system. For sighted 
voters, this automatic change resulted in candidates who had been 
selected not being voted for as intended by the voter. For audio users, no 
deselection is voiced at any time. 

• Overvoting protections do not protect audio users. Once a voter 
selects the maximum number of candidates in a contest, the system 
greys out the remaining options. This is a strong protective feature and 
intuitive for a sighted voter. The sighted voter is able to scan through the 
remaining candidates and find others who s/he might prefer, and change 
selections. However, when using the audio assistance, this way of 
handling overvote protection removes the ability for the system to read 
the remaining candidates, so a voter may not hear all of the options. 


Why is this a problem? 

The system relies on voters perceiving the change in selections and 
understanding why those changes have happened. This is a problem 
because: 
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• All voters should have control of all selections. 

• Off-screen actions force all voters into problem solving. This is worse for 
voters using the audio format or a dual switch because navigation is 
more difficult. 

• Voters with cognitive disabilities may be unable to understand what has 
happened when the interface is unpredictable and/or inconsistent. 

• If a voter has to ask for assistance in the middle of the ballot, their privacy 
and independence are compromised. 

• Ultimately, voters may vote in a way they had not intended. 

Recommendations 

While the machines must comply with the "Pennsylvania Method" of straight 

party voting, there are ways to fully inform the voter of selection and 

deselection changes. For example: 

• Create meaningful audio feedback messages and confirmation processes 
to tell voters what is happening—including the number and names of the 
candidates being deselected. No selection or deselection should ever take 
place without explicit action or confirmation from the voter. Language 
should be included like: "If you do X, these voters will be deselected" or 
"Are you sure you want to...." 

• Be consistent and toggle all selections on and off when touched or 
selected with the tactile keypad, including selections made when the 
straight party option is active. This is consistent with how selection and 
deselection works in general and is not destructive. 
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5. Paper ballot handling 

One of the goals of the voting machine upgrade is to allow all voters to vote 
independently and privately, including verifying their ballot. All paper ballots 
introduce barriers for voters with low-vision, no-vision, and with limited 
dexterity. 

Most voters appreciated the printed ballot, which allowed a second chance to 
review the vote before casting. The implementation of the printing and 
paper-handling of these paper ballots had some issues that limited the ability 
of voters to use them effectively. 


Reading the paper ballot 

For the Dominion ICX ballot marking system, the ballot is printed using a 
separate, off-the-shelf printer on 8.5 x 11-inch cardstock. The cardstock is 
stored inside the printer next to the tablet. This means that voters do not 
have to handle a blank ballot before making choices. 

It also means that there is no feature to allow a voter to "read back" the 
ballot by reinserting the printed, completed ballot into the voting system. 
Three of our five blind voters were able to use app-based print readers on 
their phone to take a picture of the ballot and read it back to them. This is 
only an option for voters with this technology. There is no built-in option for 
all voters. 

The paper ballot included alerts and language that was not used on the 
touchscreen. For example, undervoted contests are called out with 
"UNDER_VOTE_BY_N" where N is the number of positions still available. The 
ballot review screen does not do this, which means it is not announced to 
visually impaired voters using the audio assistance. 


Interacting with the ICP ballot scanner 

The scanner had both positives and negatives. In general, the ballot scanner 
does not produce any major accessible voting barriers. 

Only one feature stood out and could be considered a positive for voters 
with disabilities. 
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• Voters may insert the ballot in any orientation. This provides another 
layer of privacy and limits the potential failures. However, this was not 
clear to any of the voters or poll workers. Each asked how to insert it. 

The most serious problems are: 

• The scanner bed is very shallow so the entire ballot does not fit on it. 

Only the top third of the page can be rested on the scanner. Voters with 
no/low use of their hands would rely on assistance for feeding the ballot 
into the scanner. And the supplied privacy sleeve was of little help 
because it was not designed for use with these ballots. Some of the test 
participants commented on these issues. 

• There are no audible cues. The scanner did not include robust features 
to alert voters that their ballot has been cast successfully. 

• If the ballot is not perfectly aligned as the scanner begins to grab it, the 
scanner will spit it back out. If the voter is not ready for this, the ballot 
will fall to the floor. This is a problem for all voters but potentially very 
embarrassing and frustrating for those with disabilities. 

• There are subtle visual cues from a small screen that notify voters that 
the scanner is ready, reading a ballot, and finished scanning. These were 
not available for voters with low or no vision. Also, the quality of the 
screen is poor. If the voter or poll worker is not directly over the screen, it 
is difficult or impossible to read. 

While the voter does not spend as much time interacting with the ballot 
scanner as the touchscreen machine, there are barriers for voters with 
disabilities that can limit voter privacy and independence. If a voter must ask 
a poll worker for ballot scanning assistance, this increases the likelihood that 
the poll worker will see how the individual voted. 
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Recommendations 

For the printed ballot layout 

• Make the alerts and language on the ballot and touch screen consistent. 

For the scanner 

• Increase the length of the scanner bed so that the full ballot can sit on it 
before inserting it into the machine. This will help low mobility and 
dexterity voters and will catch the ballot if it is inserted incorrectly. 

• Make the cues more obvious that the ballot is cast. Large print words or 
simple images to indicate the scanning steps on the screen, and a 
stronger visual cue can show that the ballot scanned successfully. Adding 
a subtle audio cue that the ballot scanned properly would help blind or 
low vision voters confirm their ballot was cast. 

• Train poll worker to assist voters in ways that do not compromise the 
voter's privacy. This might include having standard instructions for poll 
workers to use to guide a voter in casting their own ballot, or narrating 
the poll worker's actions so that the voter understands what the poll 
worker is doing. 
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other issues for deployment 

A few other issues produced consistent enough observations to call them out 
in some detail. 


Alerts 

Both the poll workers and the voters were uncomfortable with the language 
of the on-screen warnings. 

In general, they felt that warnings were appropriate for conditions that might 
invalidate a ballot, where "alerts" would be appropriate for acceptable 
conditions that could be changed. 

• "If left blank, this contest will have implicit choice selections for 
party [straight party choice]." One of the most egregious involves 
any contest that is left blank, but the voter selected a straight party. 

In this case, the system provides an alert that says "If left blank, this 
contest will have implicit choice selections for party [straight party 
choice]." The system does not have an immediate way to straight 
party vote and abstain from a contest, which is a problem in and of 
itself. But the high-level language in the alert confused most voters 
and poll workers. And all said that the message needed to change. 

• "Your ballot is valid, but there are warnings." If a voter does not 
select a straight party, the review screen first indicates that "Your 
ballot is valid, but there are warnings." Then, the straight party 
contest alert indicates that "This contest is blank." The wording of this 
alert suggests that the straight party selection is a ballot contest 
rather than a convenience, and that selection is mandatory. In either 
case, the language is unnecessarily harsh and coercive. 

• "This contest is undervoted!" If a voter does not select all of the 
available candidates in a contest, they receive a warning that the 
contest is undervoted. "Undervoted" is not a clear language term, and 
is potentially confusing to voters. The warning also suggests that full 
voting is required. 
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The language of on-screen or audio "warnings" should be informative, not 
coercive, and should be in plain language. Where possible, counties should 
work with the vendor to reconfigure or rewrite these warnings. 

Poll Worker Concerns 

Poll workers were very excited about the ability of the scanner to tabulate 
absentee ballots. However, they had some concerns about the touchscreen 
and general process. 

• Power needs and cords. Several poll workers commented that the 
machine included the ballot marking tablet and a separate printer. 
They were concerned about the power requirements this would 
present in some of their polling places. Combined with the wires for 
the headphones and access switches, they felt that the number of 
cables would be a burden to manage in the polling site. 

• Lots of pieces. The poll workers were concerned about managing the 
"parts" of the process. This machine uses activation cards to select 
the appropriate primary ballot by party, and uses different cards for 
"normal" versus "accommodated" voting. In polling places that serve 
more than one precinct, each might have a different ballot. This 
suggests the need for many types of cards, or new system entirely to 
manage at the voter check-in area. The scanner also has compact 
flash cards and security keys. They did not like the idea of 
complicating the voting process with additional things. 

• Casting the ballot and traffic management. Poll workers were also 
worried that the voter must carry the ballot from the voting machine 
to the scanner and ensuring they actually fed the ballot into the 
scanner. This has been a common concern from poll workers who do 
not currently use paper ballots. However, this concern was justified in 
this instance because of the language on the print ballot screen. 

o When you press the "Print" button at the end of voting, the 
machine produces a new window with an alert. It has a 
message "Some warning detected on your ballot. You cannot 
make any more changes after casting the ballot." Then there 
are two buttons labeled: "Cast your ballot" and "Review your 
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choices." To make it worse, the finai screen says "Thank you 
for voting! Your baiiot is successfuiiy cast." This ianguage 
choice is misieading and incorrect. The touchscreen device just 
creates the baiiot and printer prints it. The baiiot is not "cast" 
untii it has been scanned by the tabuiator. 

o Poii workers became worried that voters may misinterpret 
these screens and Just waik away. Since many voters desire a 
receipt for voting (to vaiidate time off from work or credit for 
schooi), they might think that they had indeed cast their baiiot 
(because the machine said they had), and the printed copy is 
their receipt. 

o The poii workers were anxious about traffic management to 
assure that the baiiots and cards aii came to the scanner. They 
suggested that a message on screen when the baiiot was 
printed wouid heip. it couid instruct voters to take their baiiot 
and activation card to the scanner to cast their baiiot. 

• The poii workers were uneasy about the comfort ievei of the oider 
voters with change in the process. They aii agreed that having the 
machines avaiiabie in pubiic spaces (iibraries) prior to the eiection to 
aiiow voters to try them wouid be important. 

• There was some apprehension about the use of compact fiash cards 
to record taiiies. These are smaii, and may be difficuit to manage 
from some workers with iimited dexterity. 

Candidate Selection 

The Dominion software uses two ieveis of candidate seiection, which interact 
in two different ways from the point of view of the voter. 

• Soft Selection vs Hard Selection. The first ievei of seiection might be 
caiied "soft-seiection." When a voter seiects a straight party baiiot, the 
candidates from that party are soft-seiected and pre-marked 
throughout the baiiot. This wiii count as a vote uniess modified by 
action of the voter, as discussed in the "impiicit" aiert area above. 
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If a voter touches the screen to select a candidate without a straight 
party choice, this direct action creates a "hard selection." If a soft- 
selected candidate is touched by the voter, this converts the soft- 
selection to a hard selection. 

• Cannot leave a straight party contest blank. Once a voter selects a 
straight party, the machine will not allow a voter to abstain from any 
contest. As mentioned in the "Alerts" section, the machine informs 
the voter that a blank contest will be marked as straight party—even if 
the voter leaves the names unselected. As one voter discovered on 
her own, she could effectively abstain from the contest by submitting 
a blank write-in entry. This is not an appropriate work around. 

To the voter, soft-selected and hard-selected votes look the same. This is 
logically sound, but has unexpected repercussions. 

• Destructive behavior. If a voter decides that they want to remove a 
straight party selected candidate in a "Vote for N" contest, they will try 
to deselect that candidate by touching or selecting that candidate. 
Instead of deselecting the soft-selected candidate, it converts it to a 
hard selection. This was not what the voter intended, so naturally the 
voter touches the selection again. This results in deselecting the 
candidate, and also deselecting all of the other straight party votes in 
that contest. This unexpected destructive behavior confused sighted 
voters. 

• Soft-selection cue. All of our blind voters, when instructed to vote for 
an in-party candidate, reselected that candidate, making the selection 
a hard selection. This suggests that the cue that the candidate had 
already been soft-selected was not adequate to alert the voter, and 
might result in unintended cancellation of other in-party candidates. 

There were additional candidate selection issues that confused voters. 

• Number of available candidates vs number of selected 
candidates. In contests where the voter is allowed to select multiple 
candidates from the presented roster, there is no indication of the 
number of candidates available. Nor, after selecting one or more 
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candidates, is there indication of how many candidates have been 
selected. 


When the roster of candidates is longer than a single screen, or for all 
blind voters, it is not clear how many candidates are available. This 
could be remedied by messages that say "Vote for 5 of the 23 
candidates" and "You have voted for three of the allowed five votes." 
When the voter has selected fewer than the allowed number of 
candidates, they are presented with a warning that they have 
"undervoted" the contest. It was not clear to our voters what 
"undervoted" meant, and the language of the warning suggested that 
this was not a valid vote, and that all five candidates must be selected 
to be appropriate. 

Not all of the issues in this section have clear workarounds or immediate 
vendor-provided solutions. Counties should have extensive poll worker 
trainings and many opportunities for voter education to ensure all poll 
workers and voters know how to successfully cast each vote at the polls. 


Reviewing and verifying the ballot 

Voters with disabilities will also need voter education on how the ballot 
review and verification process works for the combination of presentation 
and interaction mode they are using. This is particularly important because 
of the use of straight party voting in Pennsylvania 

In this voting system, it is possible for a voter to select a straight party option, 
go directly to the review screen, and then directly to print without any 
notification from the ballot marking device that they have undervoted any 
nonpartisan contests or ballot questions. 

A blind or low-vision voter who cannot easily verify the printed ballot might 
never learn that they skipped contests, especially if the precinct ballot 
scanners are not programmed to report undervotes. 

One solution to this would be for the audio at the beginning of the review to 
announce if there are undervoted contests (and perhaps how many there 
are). 
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Recommendations for deployment 

The participants - and examiners - saw the systems being tested for the first 
time during the examination. Many voters will also try using a new system for 
the first time in the voting booth, so our test was realistic for Pennsylvania 
voters. 

The problems we encountered also suggest ideas for how election officials 
can support voters and poll workers as they introduce the new system and 
design their processes and procedures. 

The recommendations here are based on observations of how both poll 
workers and voters used the system and direct suggestions they made. 

Advanced training and hands-on practice 

The need for an introduction and a chance to try out the system before 
Election Day was the strongest recommendation from every poll worker 
participant. 

Poll workers felt strongly that any new system - particularly those with digital 
interfaces - would be intimidating to voters and fellow poll workers who 
were not used to computers. They recommended: 

• Longer training sessions for poll workers to give them more time to 
familiarize themselves with a new system. 

• Opportunities for hands-on experience, including scenarios for different 
situations they might have to handle. 

• An aggressive voter education program to give voters a chance to try out 
the new system. 

• Outreach to voters with disabilities, including those who regularly vote 
with assistance to let them know about the capabilities of a new system 
that might help them. 

• Have voting machine hands-on demonstrations at disability events so 
that voters can get to know the machines, practice voting, and be 
prepared for what they may need on Election Day. 
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• Instructions or a practice system in the polling place, especially in districts 
with many older people. 

Training for poll workers to support voters 
with disabilities 

Poll workers may not be familiar with how to help people with disabilities. 
Most of the poll worker participants said that they had no blind or disabled 
voters in their polling places, although one pointed out that the features on 
these systems might enable their "assisted voters" to try voting 
independently. 

In addition to a good training module on ways to help voters with disabilities, 
the training should focus on how to give instructions before and during a 
voting session to avoid compromising their privacy. For example: 

• A "what if" troubleshooting guide could include specific questions to ask 
and prompts that poll workers can use to help a voter with problem 
solving without looking at the screen. 

• Give poll workers guidance on where to stand while supporting voters. 

For example, standing behind the ICX and facing the voter would make it 
clear that they are not looking at the screen. 

• Using the procedures for initiating a voting session, including the screens 
to select a language or acknowledge that assistive technology has been 
activated, to make sure that the voter has found the basic navigation keys 
on the keypad. On the ICX, the setting and preferences buttons are at the 
top of the screen at all times. The poll worker can review these with the 
voter (reading the instructions to be sure they are consistent and 
accurate). 

Poll worker procedures 

Poll worker procedures can also help bridge any information gaps for voters, 
with instructions embedded in the voting process. 

• Tell voters how to insert their ballot: identify that the ballot must be 
placed in the center of the scan bed, and tell them the ballot is inserted 
directly into the machine, not just slid forward. 
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• Remind voters to check both the review screen and their paper ballot 
before casting. 

• Tell voters that if they make a mistake, they can get a new ballot. 

• Instruct voters that their ballot can be inserted into the scanner in any 
orientation. Using the privacy sleeve is the most secure. However, 
inserting the ballot upside down, with the print toward the floor, is 
sufficient. 

Support for voters using the tactile keypad or dual switch and audio ballot 

might include: 

• A keypad they can try out before entering the voting booth. 

• Instructions for how to use the keypad in Braille, audio, and large print. 

• Test all assistive aids with local voters. 

As a voter approaches the voting station, poll workers can help voters adjust 

the voting system or attach personal assistive technology: 

• Help voters get positioned at the voting system so they can reach all 
controls. The ICX screen can be adjusted to change its angle for a closer 
approach, adapting to standing or sitting postures, and avoiding glare. 

• Provide help plugging in personal headsets or switches with verbal 
instructions or by doing it for the voter. 

• A voter with a disability is likely to know how to plug in their personal 
headset or switch, but they will not know the location of the Jacks on the 
machine. On the ICX, the tactile keypad includes two 3.5mm jacks that 
seems appropriate to insert a headset. One is marked in very small 
letters that it is for audio. However, the other Jack is where the dual 
switch connects. Counties should ensure poll workers explain the two 
Jacks to voters, at a bare minimum. 

• Make sure voters are oriented and know where all parts of the voting 
system are, including the privacy shields. The ICX includes options to 
blank the screen during the audio ballot, but then poll workers could 
bring back the visual mode if the voter has a question. 

• Remind voters how to cast their ballot and how to know when they are 
finished. 
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Polling place setup 

Ensure all polling locations have at least one accessible voting booth with a 
chair that is easily removed if a voter uses a mobility device. 

Voters with disabilities may have assistive technology or personal notes that 
they need to place within reach. They may also need room to place the 
printed ballot on a flat surface when using simple personal technology, such 
as magnifiers or text readers to verify it. 

For all voting machines, the path to the touch screen and the scanner should 
be as easy as possible, ideally a straight line with no obstructions. The path 
should include ample room to turn a wheelchair if the machine is positioned 
with the screen facing the wall. The ADA standards suggest a minimum of 
60x60 inches for this. 

Use assistive technology to support blind and low-vision voters in verifying 
their ballot, for example, a magnification unit or a simple OCR scanner. 

Voting booth setup for this system 

Two issues were identified specifically for this system during the examination 
and usability testing related to how the system and attached devices are 
placed. The system fits very tightly in the accessible voting booth supplied by 
the vendor for the exam. 

• Cable management for assistive devices. The tactile keypad is normally 
stored behind the screen, connected on a semi-permanent cord. The 
headphone is plugged in on the right-side front of the tactile keypad. The 
printer could be set up to the right or left. 

Recommendation: The cords need to be placed so that they don't 
interfere with the printed ballot or the voter's ability to find and take it. 

• Privacy. The screen for this system sits close to the front of the booth. It 
is easy to read the crisp, clear screen display over the shoulder of 
someone sitting down, or from the side, especially when large text is 
used. 

Recommendation : Position the booth so the voter's back is to a wall, so 
no one can walk behind them, and with sufficient space to the left and 
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right that people cannot "peek" from the side. However, be sure that 
there is a good path for a manual or motorized wheel chair to get to the 
voting booth easily (see above). 
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All observations 


Voter comments and reviewer observations about each machine are 
described below. For each are, the observations are organized by the 
machine function then by the severity. 

Positives 


Function 

Observation 

System 

Severity 

General 

Blind voter/poll worker - "Once 1 understand the 
system, 1 can whiz!" 

ICX 

Positive 

Display and 
Navigation 

Large, clear, easy to read screen. The screen 
angle can be changed to three angles: flat, slight 
incline, and almost vertical. 

ICX 

Positive 


Default font large enough for most sighted 
voters. 

ICX 

Positive 


The system prevents overvotes by greying out 
the remaining options once the voter has 
selected the maximum number of candidates in a 

contest. 

ICX 

Positive 


Alerts are generally well formatted and in 
appropriate places. The wording in the alerts is 
not good, however. (See Problems section below) 

ICX 

Positive 


The ballot review button is always visible and 
functional. Voters don't have to review the entire 
contest or ballot to navigate to the review screen. 
Likewise, the print ballot button is always 
available from the review screen. 

ICX 

Positive 


Large "scroll down/up" buttons at the top and 
bottom that span the width of the screen. 

ICX 

Positive 


Straight party vote indicator that allows you to 
turn on and off straight party votes at any point. 

ICX 

Positive 
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Function 

Observation 

System 

Severity 

Display and 
Navigation 

Ballot review screen is generally well formatted. 
Alerts are present in each contest where 
necessary. In blank or undervoted contests, a "No 
selection made" label is present for each 
potential vote for number. 

ICX 

Positive 

Assistive 

Technology 

(AT) 

Voter - "The disability functions are the best 
features." 

ICX 

Positive 


AT includes an audio mode that leaves the screen 
enabled. The first screen touch reads the 
selection, and then the same item touched a 
second time selects it. 

ICX 

Positive 


If the voter chooses the assistive technology, the 
touch screen is still active for those who may 
want to use both. 




Poll worker commented that these machines 
would help counties find accessible locations for 
the machines. 



Write-In 

Screen 

Once a blind voter found the on-screen keyboard, 
they were able to enter the candidate name 
quickly. 

ICX 

Positive 


After completing the write-in, one blind voter 
said, "That was easy." 

ICX 

Positive 

Printed 

Ballot & 

Scanner 

While sighted voters (and poll workers) generally 
did not want to check the printed ballot, blind 
voters generally did. The use of card stock made 
the ballot easy to handle. The card reader at the 
base of the screen created a make-shift easel. 
Voters could rest the ballot against the machine 
and use personal AT devices to verify their ballot. 

ICX/ICP 

Positive 


Seeing Al and other personal AT were able to 
read the printed ballot to the voters successfully 
who attempted it. 
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Function 


Observation 


System Severity 


Printed After the ballot printed, one voter responded ICX 

Ballot & "Neat!" 

Scanner 


Positive 
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Problems 


Function 

Observation 

System 

Severity 

Setup for 
Voters 

Concern about the power requirements 
(marker and printer use separate power 
cords) and confused cables for tactile keypad, 
speaker, switches, and headphones with 
power cords. Counties will need to ensure 
polling locations have enough outlets 
available, and they will need to think of 
strategies to contain the cords. 

ICX/ICP 

Annoyance 


This machine has a lot of additional parts: 
memory cards, voter cards, access keys. 

ICX/ICP 

Annoyance 


"Seems like a lot of parts to the process. Our 
voters will get confused." 

ICX/ICP 

Annoyance 


Poll workers were concerned if their county 
did not switch to an electronic poll book, then 
they would have to have another system to 
create voter cards on demand. 

ICX/ICP 

Annoyance 


Poll workers felt that early hands-on exposure 
to the machines should be provided several 
weeks before the election, so that voters could 
become familiar with the process. 

ICX/ICP 

General comment 

Privacy 

Because of the large screen size and clear 
print, some voters were concerned about 
privacy. It was easy to read the display from 
several feet away. 

ICX/ICP 

Annoyance 


When privacy cover is used on ballot, the 
ballot cannot be inserted to the bottom of the 
sleeve. The top of the ballot must be outside 
the sleeve for the scanner to pick it up. 

ICX/ICP 

Annoyance 

Orientation 

and 

Navigation 

For one contest on the sample ballot, (County 
Commissioner), the down-contest candidates 
are not visible on the initial screen. If it were 

indicated that there were "X Candidates" in 
total, the voter would be cued to scroll down 
to find them. 

ICX 

Problem solving 
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Function 


Observation 


System Severity 


Orientation If a voter wants to quickly vote straight party, ICX 
and the system allows selecting straight party, 

Navigation then review, then print. In this process, 

however, the voter is never presented with 
the ballot questions. If they do not review 
their ballot entirely, they receive no warning 
that any non-partisan contests are blank. 

As part of the overvote protection, the ICX 

additional candidates or options are greyed 
out once the maximum number of selections 
has been reached. However, this means that 
the audio does not announce the additional 
candidate names. This could lead to a voter 
missing a desired candidate. 

When using the audio, the straight party ICX 

button is present in all contests. Every blind 
voter got stuck on this button and the 
instructions are unclear as to what the button 
is or how to navigate away from it. 

No blind voter was able to do the write-in ICX 

process without some assistance. Most 
navigated to the box where the name 
appears, and stopped. No instructions 
describing the process are available. Once the 
voter pressed the down or right arrow buttons 
enough times, they discovered the keyboard, 
and oriented themselves within the layout. 

It is not obvious that to change your vote, you ICX 
have to deselect the chosen candidate to 
bring back the check boxes on the other 
candidates. 


Problem solving 


Likely to prevent 
independent voting 
for voters with 
some disabilities 


Needs Assistance 


Needs Assistance 


Problem Solving 


Orientation 

and 

Navigation 


In ballot contests, the keypad navigation ICX 

wraps from bottom to top, but not from top to 
bottom. In dialogs, the navigation wraps both 
ways. This inconsistent behavior can be 
confusing, and results in inefficient operation. 


Problem Solving 
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Function 


Observation 


System Severity 


Orientation 

and 

Navigation 


On contests that have a number of votes ICX 

allowed, there must be the same number of 
write-in opportunities. When navigating by 
audio, each of these is announced as "Write- 
in" with no variation in speech. For those 
depending on this feedback, it is not clear that 
they are moving through different selections 
on the ballot. A voter recommended that it 
say "Write in #1, Write-in #2..." to clarify this. 

One voter accidentally selected the ballot ICX 

"Review" button rather than "Next," after 
making the first selection in a contest. 

There are four ways to insert the card, only ICX 
one of which works. For a blind voter, the 
activation card does not have an indication of 
the correct orientation. (Only the visual 
display provides instructions). Although all of 
our blind voters were able to feel the 
integrated circuit on the card, some 
instruction is needed on how to insert the 
card. One voter suggested a small Braille dot 
on the card as a cue. 

At the top of the display at all times there are ICX 
controls for text size, contrast, and language. 

For AT users to navigate to these controls, 
they must press "Select" while the contest title 
is active, then they can scan through the 
settings. Used in this way, the select button is 
inconsistent between selecting choices and 
navigation, which will be an issue for those 
with cognitive disabilities. Some blind voters 
were tripped up by this. 

Sighted voter felt that the instruction for the ICX 
number of available votes (Vote for N) should 
be larger, and spaced down from the contest 
title. 

A sighted poll worker was surprised when the ICX 
"Next" button changed to "Review." Suggested 
"End of Ballot" message. 


Problem Solving 


Problem Solving 


Problem Solving 


Problem Solving 


Annoyances 


Annoyances 
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Function 


Observation 


System Severity 


Audio 

Instructions 


While reviewing the ballot, the voter can jump ICX 
back to individual contests and make changes. 

The review ballot button, to return to the 
review process always returns to the top of 
the ballot. On long ballots, with voters who 
make multiple changes, this is an unnecessary 
burden. 

If the voter is looking at the second contest on ICX 
a single screen, making the text larger can 
cause that contest "disappear." It actually 
moves to the next page, but that isn't obvious. 

Poll worker (retired user interface designer) ICX 
indicated that there should be more space 
between "Scroll down" and "Print" buttons on 
the review screen. He accidentally pressed it 
a few times. 

The Up/Down and Left/Right buttons on the ICX 
tactile keypad perform the same navigation. 

Once voters discovered it, they used only one 
set of buttons. 

Several voters and candidates attempted to ICX 
navigate by swiping, it is not enabled on this 
system. 

For voters using the dual switch input, on ICX 

contests with many candidates, the "Next" 
button requires many, many button presses. 

It can cause voters to overshoot their target, 
and have to do it again. 

When text is enlarged, text size stays the same ICX 
in alert messages in a different window. 

Ballot header instructions are centered. ICX 

When instructions are longer than a few 
words, the Justification can chop up sentences 
strangely. 

Blind poll worker said "Oh!" In response to the ICX 
content voice. Then said, "Oh, that's terrible!" 


Annoyances 


Annoyances 


Annoyances 


Annoyances 


Annoyances 


Annoyances 


Annoyances 


Annoyances 


Problem Solving 
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Function 


Observation 


System Severity 


Audio 

Instructions 


The voice used for the audio feedback was 
described by voters as "crappy" and "rinky- 
dink." Truncates words at high speeds. The 
word "write-in" was rendered as "ret." 

ICX 

Problem Solving 

The rate range of the content voice (difference 
between slowest and fastest rate) was much 
higher than the instruction voice. When 
adjusting, the voter can only hear the 
instruction voice, so may require several tries 
to get the voice to a desired rate. 

ICX 

Problem Solving 

The audio instructions are repeated too 
quickly after pausing on a selection, and they 
are repeated too often after each navigation. 

ICX 

Problem Solving 

"The audio instructions are needlessly 
complicated." 

ICX 

Problem Solving 

'The [audio] instructions are kind of 
confusing." 

ICX 

Problem Solving 

Blind voters indicated that they wanted a 
verbosity control for the audio instructions. 
"Give me detailed instructions the first time, 
then shorter after that, but let me get full 
instructions again if 1 need them." 

ICX 

Problem Solving 

Several voters indicated that they wanted 
contextual help, not a repeat of the 
instructions for the tactile keypad when 
pressing "Help" 

ICX 

Annoyance 

After going through the instructions for the 
keypad, the voter asked, "How do 1 get out of 
here." It wasn't clear that pressing the "Select" 
button ended the instructions and moved 

back into the ballot. 

ICX 

Problem Solving 

At the ballot header screen, the audio 

ICX 

Problem Solving 


instructions do not say what to do to enter the 
contests. Voters repeatedly got stuck. 
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Function 


Observation 


System Severity 


The straight party button at the beginning of 
every contest confused all of the voters. The 
audio announces it as "Selected straight party 
candidate republican" and then immediately 
beings to give instructions on how to select 
the button. 

ICX 

Problem Solving 

The straight party button audio instructions 
are confusing to voters. The visual version is 
confusing as well. (See more in Alerts section 
below.) 

ICX 

Problem Solving 

When you override a straight party vote, the 
audio still announces the straight party button 
as "selected straight party" even though none 
are selected. 

ICX 

Problem Solving 

One blind voter was confused by the audio 
instructions. When the machine instructed her 
to press the "right" button, she interpreted 
this as the right-hand button, not the right 
arrow under her left hand. 

ICX 

Problem Solving 

When the blind voter hit the wrong button on 
the "Review Screen" button, and moved to the 
top of the contest, "1 doesn't tell me that 1 
didn't go to the review. It takes me back to the 
top." 

ICX 

Problem Solving 

All blind users reselect candidates selected by 
straight party choice. This could suggest that 
the cue that they are selected is not strong 
enough. 

ICX 

Problem Solving 

In the testing process, the voter was 
instructed to vote for the candidate that was 
endorsed by both parties. On first pass, this 
was missed because the pause between 
"Republican" and "Slash" made it sound as if 
only one party was involved. 

ICX 

Needs Assistance 

There are no audio or on-screen instructions 
for any of the other assistive devices (buttons, 
sip-and puff). 

ICX 

Needs Assistance 
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Function 

Observation 

System 

Severity 

Straight Party 
Voting 

Once a voter chooses a straight party option, 
the system will not let them abstain from a 
partisan contest. It gives the voter an alert 
that says that even though the contest is 
blank, the candidates that match the straight 
party will be selected. (See more in the Alerts 
section below.) 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


Overriding a straight party vote deselects the 
straight party selections. In contests where 
the Vote for N number is greater than the 
straight party candidates, voters tried to select 
additional candidates, but had to reselect 
straight party candidates. 

ICX 

Problem Solving 


If you have overridden your straight party 
vote in any contest, the system will not allow 
you to cancel your straight party choice 
without de-selecting the out-of-party votes. All 
voters who tried to cancel their straight party 
had to ask how to do it. 

ICX 

Needs Assistance 


Voters complained that the system seemed to 
require a straight party vote. They thought it 
should have instructions indicating that if they 
do not want to vote straight party, they should 
select "Next." 

ICX 

Problem Solving 


Some voters thought that the straight party 
option selected the party's ballot, as in the 
primary. Poll workers independently reported 
the same concern, even they knew the 
function. Both groups said the instructions 
were unclear. 

ICX 

Annoyances 

Alerts 

The wording of the alerts is not good. Some 
language was too high level. One message 
uses the word "implicit." 

ICX 

Problem Solving 
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Function 


Observation 


System Severity 


Alerts 


Alert: If left blank, this contest will have ICX 

implicit choice selections for party [straight 
party choice] appeared in any contest where a 
voter made no candidate selection. Most 
voters and poll workers had no idea what this 
meant. 

One poll worker said "This will get us sued. ICX 
Voters will say that 700 changed my vote!'" in 
response to the "implicit" alert in a blank 
straight party contest. 

Most alerts begin with "Warning" which voters ICX 
and poll workers found too overbearing. 

One blind vote indicated "I don't like ICX 

'warnings.' I would like to have information 
about how to proceed or correct an error." 

The poll workers did not like "warnings." They ICX 
preferred information about options to fix 
them. 

When no selection is made in the straight ICX 
party contest, the system generates a 
message "Warning, this contest is left blank!" 

Voters thought they had to make a selection. 

The straight party cancel alert language and ICX 
button labels are overly confusing. This is 
especially true in the audio instructions. 

The straight party audio instructions are too ICX 
wordy and complicated. It asks the voter to 
"select 'Confirm' to cancel or 'Cancel' to 
cancel." 

Many voters thought that the undervoted ICX 
contests warning implied that they were 
required to vote for the maximum number of 
candidates. 


Problem Solving 

Problem Solving 

Problem Solving 
Problem Solving 

Problem Solving 

Problem Solving 

Problem Solving 

Problem Solving 

Problem Solving 
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Function 

Observation 

System 

Severity 


On the review screen, a poll worker 
questioned the location of the message that 
"Your ballot is valid, but you have warnings." 
Rather than being located at the top of the 
screen, she suggested that it be placed 
between Scroll Down and Print. She said she 

almost missed it. 

ICX 

Problem Solving 


On the review screen, a poll worker thought it 
would be better if the alert icons could be 
touched for more information and options. 

ICX 

Problem Solving 

Printing/Ballot 

Verification 

After you press "Print" at the bottom of the 
screen, the alert window warns you that you 
are about to "Cast" your ballot. This action 
does not cast your ballot. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


After you print your ballot, the machine 
displays a message "Thank you for voting! 

Your ballot is successfully cast." This action 
does not cast your ballot. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


Poll workers reported that the "your ballot is 
cast" language will be a problem because 
voters might leave without putting their ballot 
in the scanner thinking it is their receipt. 

ICX 

Needs assistance 


Poll workers thought that the final screen 
should instruct voters to take their ballot and 

their voter card to the scanner. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


The printed ballot reports undervoted 
contests as "UNDER_VOTE_BY_N" where N is 
the number of positions still available. 

The ballot review screen does not do this, 
which means it is not announced to visually 
impaired voters using the audio assistance 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


Printed ballot displays no straight party 
selection as being "Blank contest." 

ICX 

Problem Solving 


Alerts on printed ballot not informative and 
confusing. Poll workers thought that voters 
might think something is wrong since the 
ballot review screen said something different. 

ICX 

Problem Solving 
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Function 

Observation 

System 

Severity 


One voter suggested printing arrows at the 
top of the ballot to match those on the 
scanner, indicating the correct alignment. 

Even when the scanner accepts the ballot in 
all orientations, this provides a hint that will 
reduce confusion. 

ICX 

Annoyances 


One poll worker suggested that the printed 
ballot should look more like the historical 
paper ballots. 

ICX 

Annoyances 

Write-In 

Screen 

Using the audio, when a typo is being 
corrected, the letter just deleted is not 
announced. This makes it difficult to 
impossible to know where you are in the 
process. 

ICX 

Problem solving 


Using the audio, when deleting characters to 
correct a misspelling, the audio feedback is 
"Delete" but does not announce the letter 
being deleted. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


When the voter leaves the Write in screen, the 
audio instructions say "You have written in " 
and spells the name entered. However, it does 
not voice the space, so the voter may think 
that they failed to enter it. 

"It didn't tell me 1 had a space. 1 know 1 put 
one in." when writing in a candidate using the 
audio assistance. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


No blind voter was able to complete the write- 
in process without some coaching to continue 
moving down the write-in page until they 
found the alphabet. Once they found the 
alphabet, they were able to proceed quickly. 

ICX 

Needs Assistance 
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Function 


Observation 


System Severity 



When writing in a candidate using the audio, 
each letter typed is spoken. If the user pauses, 
the last audio information is repeated. If the 
letter is entered again, (for names with double 
letters), the spoken feedback sounds exactly the 
same as the repeated feedback from the last 
entry. There is a high risk of inadvertent doubles 
or single letters. Repeated feedback and new 
feedback should sound different. 

ICX 

Likely to prevent 
independent voting 
for voters with 

some disabilities 


No blind voter was able to complete the write- 
in process without some coaching to continue 
moving down the write-in page until they 
found the alphabet. Once they found the 
alphabet, they were able to proceed quickly. 

ICX 

Needs Assistance 

Write-In 

Screen 

In standard mode, once you have entered a 
write-in, you cannot correct it because 
touching it deselects it. Then when you go 
back into the write-in screen, it has removed 
the entry. 

ICX 

Problem Solving 


The page for write-in candidates doesn't actually 
provide instructions on howto do the write-in. 
This is true for standard mode and audio 
instructions. Audio voters must continue to 
press down or right to get beyond the text box 
and editing buttons to find the keyboard. 

ICX 

Problem Solving 


While using the audio, one blind voter 
suggested that she might use Help to figure 
out how to use the Write-In Screen. Help only 
repeats the instructions for the keypad, and 
does not provide contextual help as expected. 

ICX 

Problem Solving 


"It doesn't tell you how to do a write-in, does 
it? You would never know to press down 
again." 

ICX 

Problem Solving 


"OK, 1 guess 1 have to go all the way to the 
end," said one voter when trying to find the 
write-in screen keyboard in audio mode. 

ICX 

Problem Solving 
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Function 


Observation 


System Severity 



When navigating the keyboard, the "period" 
key is announced as "dot." While this makes 
sense in some applications, names include 
periods, not dots. 

ICX 

Annoyances 


Poll Workers: Expected QWERTY layout for on¬ 
screen keyboard, but when saw that switch 
access scanned in order, saw the logic of the 
layout. 

ICX 

Annoyances 

Assistive 

Devices 

Poll workers felt that the keypad has too many 
buttons. 

ICX 

Annoyances 


The "Left/Right" and "Up/Down" buttons do 
exactly the same thing. Why are they both 
included? 

ICX 

Annoyances 

Assistive 

Devices 

There is no dedicated button on the tactile 
keypad to move to the next contest. 

ICX 

Annoyances 


The help button of the tactile keypad repeats 
the instructions for how to use the keypad. 
Blind voters suggested context help on the 
contests, indicating how to write in a 
candidate, how to select candidates, etc. 

ICX 

Annoyances 


The headphone and switch ports on the tactile 
keypad have no Braille markings, and are very 
difficult to see for sighted voters. 

ICX 

Annoyances 


If a voter chooses any assistive device, the 
touchscreen remains active, but each 
selection must be touched twice. 

ICX 

Annoyances 


When used for long ballots, the buttons tend 
to slide. A person who needs to use the 
paddle switches may not be able to effectively 
reposition them. They should be provided 
with small non-slip pads to hold them in place 
more strongly. 

ICX 

Annoyances 


The colors of the button switches (red and 
blue) were taken to indicate party affiliation. 

The buttons are provided with green and 
yellow caps as well, and non-partisan colors 
should be used. 

ICX 

Annoyances 
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Function 

Observation 

System 

Severity 

Scanner 

The scanner provides no audio feedback to 
the blind voter. 

ICP 

Annoyances 


Scanner screen very hard to read at all, 
impossible from seated position 

ICP 

Annoyances 


Entry tray for ballots is very small - not long 
enough to support the entire ballot 

ICP 

Annoyances 

Scanner 

Memory cards for poll workers are very small 
- hard to handle - dexterity problems 
handling them. But at least not the teeny tiny 
ones (Compact Flash cards rather than SD 
cards) 

ICP 

Annoyances 


"All that [absentee] paperwork after the 
election [is gone]. Whoopee!" One poll worker 
said after realizing they could scan absentees 
instead of tallying them by hand. 

ICP 

Annoyances 
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Top positives 

The expert examination, voter experiences, and poll worker sessions 
recognized several positives of these voting systems. 


Independent voting 

Generally, voters were able to complete their ballot on the ICX and ICP 
independently, once the facilitator/poll worker provided them with the 
appropriate accessibility features. No one found the system so difficult or 
frustrating that they were unable to vote, although several participants 
identified features that they felt would frustrate less competent voters. 


Access features easily learned and helpful 

As voters explored the access features, they seemed to learn them relatively 
easily. Most of the voters use similar assistive devices daily or when they 
vote. 

After a very brief overview of each machine, the facilitator asked poll workers 
to demonstrate that they understood the function of each access feature by 
offering the appropriate option to the roll-play voter. Poll workers set up the 
machines successfully with minimal help - a reasonable outcome for an 
initial introduction to the system. 

All four poll worker groups reported that the access features would help 
voters who already visit their location on Election Day. They also agreed that 
these features would likely assist other voters with disabilities that do not 
currently come to the polls on Election Day. 

Default text size 

The default text size was large enough for most of the participants. Once the 
voters discovered the settings button and options, they could easily change 
the font size. Only one voter required a larger font size to read the screen 
more easily. 
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Visual interface clean and intuitive 

The examiners observed that the visual interface had aspects that would be 
intuitive to voters. Some voters echoed this as they experienced the 
machines, and others demonstrated the good design through use. 

• Selection behaviors. As voters make selects, the screens behaved as 
expected for a modern touch interface. 

o Candidate selection. Selecting options within each contest 
was intuitive for voters. Touching the option once put a mark 
in the box for that candidate. Touching again removed the 
mark. Straight party votes were cleanly marked in each 
contest. 

o Overvoting. When voters have selected the maximum number 
of available candidates in a contest, the remaining candidates 
grey out. In this state, they are visible to the voter, but the 
voters are unable to select them. This behavior is not mirrored 
in the audio, though, and is a major problem for audio users. 
More discussion on this issue can be found in the problems 
section. 

o Undervotes. If voters have not selected the maximum number 
of allowed candidates in a contest, the candidates remain 
highlighted and available for selection. Visually, this becomes a 
noticeable pattern and voters quickly learn in which contests 
they could select additional candidates. 

o Straight party. If the voter selected a straight party option at 
the beginning of the ballot, the system placed a button Just 
below the contest header and instructions in each partisan 
contest. This was an intuitive reminder to the voters that they 
had voted straight party. 

• Furthermore, If the voter had selected a straight party option, the 
system did not grey out the remaining candidate names, but the 
matching straight party candidates had a check next to them. Voters 
who understood the straight party method seemed to understand 
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that they could make changes if necessary, but did not need to make 
additional selections. 

• Alerts structure. While marking the ballot, if the voter left a contest 
blank or undervoted in a contest, for example, the system would alert 
the voter. The alerts were generally well placed and formatted in a 
way that makes sense to the voter. Also, if the voter wanted to 
change a straight party selection, the system alerted the voter in a 
new differently formatted tile. The same is true right before they 
printed the ballot. 

All this said, the text in the alerts is small and the wording used in the 
alerts was not good and will be discussed in the problems section 
below. 

• Review screen. The review screen was formatted well and generally 
intuitive. For any contest that was blank or undervoted, the system 
provided an alert and the label "No selection made" for each of the 
available candidate spots. This made it easy for voters to recognize 
how many selections they could make. 

Printed ballots verifiable and accessible 

The ICX prints the ballot selections on an 8.5 x 11 -inch piece of heavy 
weighted paper. The text is small but could be read by all the sighted voters. 
They all agreed that this satisfied verification for them. 

Voters with low-vision, however would not be able to read the printed ballot 
without a magnifier or other assistive technology. The print on the ballot was 
much smaller than the on-screen tex. 

Three of the blind voters were able to use a phone-based app that took a 
picture of the ballot and then read its contents back to them. Each of the 
voters who used this option were satisfied with this as the verification step. 
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Attachment C - 

- Implementation Attestation 
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attestation Dominio 
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Wi/ Pennsylvania 

DEPARTMENT OF STATE 


Voting System Implementation Attestation 


System Name: 
County:_ 


Date Installed/Upgraded: 


The below hardware/software was installed and verified on the system implemented: 


System Component 

Software or 

Firmware 

Version 

Flardware Version 

Model 

Comments 

(Please specify the 
implementation details, 
single device 
/(de sktop/1 aptop), 
Client/server/ as applicable 

EMS Election Event Designer 
(EED) 

5.5.12.1 




EMS Results Tally and 
Reporting (RTR) 

5.5.12.1 




EMS Application Server 

5.5.12.1 




EMS File System Service (ESS) 

5.5.12.1 




EMS Audio Studio (AS) 

5.5.12.1 




EMS Data Center Manager 
(DCM) 

5.5.12.1 




EMS Election Data Translator 
(EDT) 

5.5.12.1 




ImageCast Voter Activation 
(ICVA) 

5.5.12.1 




EMS Adjudication 

5.5.8.1 
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EMS Adjudication Service 

5.5.8.1 




Smart Card Helper Service 

5.5.12.1 




ImageCast Precinct 

5.5.3-0002 




ImageCast Central 

5.5.3.0002 




ImageCast X 

5.5.30 






























Further to the key hardware/software components listed above, any of the COTS software and 
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oncillory components like switches, ballot boxes, charging carts sold on this contract are EAC 


certified components of the Dominion Democracy Suite 5.5A electronic voting system. (Attach a 
list of items sold on this contract.) 

Dominion has validated that the systems have been installed and hardened following the EAC 
certified system hardening instructions and no software other than the voting system software 
has been installed on any of the components. 

Vendor Representative Signature:_ 

Vendor Representative Name:_ Title:_ 

Telephone:_ Email:_ 


County Representative Signature: 


County Representative Name:_ Title: 



Attachment D - Minimum Training Requirements 


Dominion must provide training and training materials as set forth below prior to the first use of 
the voting system in a primary or general election. 

a) A demonstration of and training on the setup and operation of the Voting System to the 
purchasing county’s board of elections’ members and staff and the county’s precinct election 
officials. 

b) A training session on the Voting System’s election management system and/or EPBs for the 
purchasing county’s board of elections’ members and no less than two and no more than six staff 
members chosen by the board of elections. The training sessions must afford the board members 
and its staff the opportunity to learn how to setup and program an election, and if applicable 
design and layout ballots independently of the Supplier’s assistance and support. 

c) A training session on the following subjects for the purchasing county’s board of elections’ 
members and no less than two and no more than six staff members chosen by the board of 
elections: 

i. programming of all voting units and ancillary devices; 

ii. tabulating results during the unofficial and official canvass; 

iii. ensuring accuracy and integrity of results; 

iv. preparing polling places and setting up the system for election day operation; 

V. Training on accessibility options of the voting system 

vi. Election day operating procedures; 

vii. auditing procedures; 

viii. conducting a recount; 

ix. preserving records; 

X. printing, designing, and formatting election reports; 

xi. troubleshooting common issues; 

xii. safeguarding and preventing tampering and unauthorized access to all parts of the Voting 
System; and 
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xiii. Post-election care, maintenance and storage. 

d) Any and all system manuals necessary to allow a purchasing county to operate the Voting 
System independently of the Supplier’s assistance and support. 

e) Training materials for a purchasing county board of elections to use when training its precinct 
election officials on how to setup, operate, and close down the Voting System on Election Day. 
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Attachment E - Source Code Escrow Obligations for Dominion 

The Supplier must maintain an escrow agreement covering all source codes of the Voting System 
and/or EPB for a period of ten years from the date of delivery to and acceptance by a purchasing 
county board of elections. The Pennsylvania Secretary of the Commonwealth shall have the right 
to access the source codes in escrow subject to the conditions specified below in subsection (d). 
The Supplier must pay all costs associated with 1) placing the codes in escrow and 2) verifying 
that the Supplier has placed the codes in escrow (note: the escrow agent conducts this 
verification and charges a separate fee for this service). 

a. Source code. Simultaneously with delivery of the Voting System and/or EPB software to 
purchasing Members, the Supplier shall deliver a true, accurate and complete copy of all 
source codes relating to the software to an escrow agent. 

b. Escrow. To the extent that Voting System and/or EPB software and/or any perpetually- 
licensed software include application software or other materials generally licensed by 
the Supplier, Supplier agrees to place in escrow with an escrow agent copies of the most 
current version of the source code for the applicable software that is included as a part of 
the Services, including all updates, improvements, and enhancements thereof from time 
to time developed by Supplier. 

c. Escrow agreement. An escrow agreement must be executed by the parties, with terms 
acceptable to the Commonwealth prior to deposit of any source code into escrow. 

d. Obtaining source code. Supplier agrees that upon the occurrence of any event or 
circumstance which demonstrates with reasonable certainty the inability or unwillingness 
of Supplier to fulfill its obligations to Commonwealth under this Contract, 
Commonwealth shall be able to obtain the source code of the then-current source codes 
related to Voting Systems software, EPB software, and/or any Supplier Property placed 
in escrow from the escrow agent. 
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